DECK-0

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:01 PM UTC
• Version: 1.0.1

Overview

This DECK-0 skill is coherent, but it needs Review because it can sign live blockchain transactions and documents raw private-key fallback flows without strong per-transaction safeguards.

Install only if you intend to use DECK-0 wallet-linked features. Prefer a runtime wallet, hardware wallet, or dedicated low-value wallet, avoid DECK0_PRIVATE_KEY for real funds, and manually confirm chain, contract address, pack IDs, quantity, total value, and gas before any transaction. Expect app.deck-0.com to receive wallet addresses, signatures, collection activity, recap data, and publisher application content.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: auth.md:128
• Finding: Wallet private key exposed through command-line arguments<![CDATA[ ## Vulnerability Details **File Location**: `auth.md:86,128`; `smart-contracts.md:164-169,196-201,224-228`; `examples.md:130-135,173-177` **Vulnerability Type**: Sensitive credential exposure through process arguments **Risk Level**: High ### Vulnerable Code `auth.md:86` ```bash WALLET=$(cast wallet address --private-key "$DECK0_PRIVATE_KEY" | tr '[:upper:]' '[:lower:]') ``` `auth.md:126-128` ```bash local signature signature="$(cast wallet sign --private-key "$DECK0_PRIVATE_KEY" "$payload")" ``` `smart-contracts.md:164-169` ```bash # Fallback signing: require DECK0_PRIVATE_KEY so unset env fails fast : "${DECK0_PRIVATE_KEY:?DECK0_PRIVATE_KEY must be set for fallback signing}" # Requires: auth helpers from auth.md (sign_request, make_authenticated_request, etc.) WALLET=$(cast wallet address --private-key "$DECK0_PRIVATE_KEY" | tr '[:upper:]' '[:lower:]') ``` `smart-contracts.md:196-201` ```bash tx_hash="$(cast send "$contract" \ "mintPacks(address,uint256,uint256,uint256,bytes,bytes32)" \ "$WALLET" "$quantity" "$price_in_native" "$expiration" "$sig" "$nonce" \ --value "$value" \ --private-key "$DECK0_PRIVATE_KEY" \ --rpc-url "$rpc_url" \ --json | jq -r '.transactionHash')" ``` `smart-contracts.md:224-228` ```bash tx_hash="$(cast send "$contract" \ "openPacks(uint256[])" \ "$pack_ids" \ --private-key "$DECK0_PRIVATE_KEY" \ --rpc-url "$rpc_url" \ --json | jq -r '.transactionHash')" ``` `examples.md:130-135` ```bash cast send "0x1a2b3c4d5e6f7890abcdef1234567890abcdef12" \ "mintPacks(address,uint256,uint256,uint256,bytes,bytes32)" \ "$WALLET" 2 813008130081300813 1706200120 "0x1234567890abcdef..." "0xabcdef1234567890..." \ --value "$VALUE" \ --private-key "$DECK0_PRIVATE_KEY" \ --rpc-url "https://rpc.apechain.com" ``` `examples.md:173-177` ```bash cast send "0x1a2b3c4d5e6f7890abcdef1234567890abcdef12" \ "openPacks(uint256[])" \ "[42,43,44]" \ --private-key "$DECK0_PRIVATE_KEY" \ --rpc-url "https://rp ...[truncated 2492 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all uses of `--private-key "$DECK0_PRIVATE_KEY"` from documented commands. 2. Prefer the runtime-provided wallet or Base wallet signer, as already described by the Skill. 3. For local fallback signing, use an encrypted Foundry keystore or a hardware wallet rather than a raw environment variable. 4. Require explicit user confirmation that displays the chain ID, verified contract address, recipient, quantity, payment value, and estimated gas before submitting a transaction. 5. Ensure shell tracing is disabled around signing operations and never enable `set -x` while secrets are accessible. 6. Avoid placing raw keys in environment variables where practical; environment data can also be exposed by diagnostics and child processes. 7. Use a dedicated low-value wallet with only the funds and permissions required for the requested transaction. 8. Document a key-rotation and incident-response procedure for users who may already have executed the affected examples. ]]>

T08 · Insecure Dependencies

Warning

• Location: README.md:7
• Finding: Unpinned third-party Skill installation creates supply-chain risk<![CDATA[ ## Vulnerability Details **File Location**: `README.md:7-10` **Vulnerability Type**: Unpinned and mutable third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```markdown ## Installation ```bash npx skills add signorcrypto/deck0-skills ``` ``` ### Technical Analysis The installation command identifies the Skill by a mutable third-party repository or package name without pinning a version, commit digest, release artifact checksum, or cryptographic signature. Consequently, the content installed in the future may differ from the content reviewed in this audit. A compromised maintainer account, repository takeover, malicious future update, or dependency-resolution change could cause users to install modified Skill instructions or executable support files. The use of `npx` also delegates package resolution and execution to the surrounding Node.js package ecosystem. Without an immutable reference and integrity verification, users cannot reliably establish that the downloaded content is identical to the audited project. ### Attack Path 1. An attacker compromises the upstream maintainer account, repository, release process, or package-resolution path. 2. The attacker publishes or serves a modified version under the same mutable identifier. 3. A user runs `npx skills add signorcrypto/deck0-skills`. 4. The installer resolves the current upstream content rather than the version audited here. 5. The malicious Skill is installed and subsequently loaded by an agent. 6. The altered content can attempt instruction hijacking, credential theft, unsafe transactions, or execution of malicious scripts, depending on the installer's behavior and runtime permissions. ### Impact Assessment The exact impact depends on the content introduced upstream and the privileges granted to the installed Skill. In this project, the Skill is expected to interact with wallet signers, network APIs, command-line tools, and blockchain transactions. A malicio ...[truncated 482 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the installation to an immutable release version or full commit hash. 2. Publish SHA-256 checksums for release artifacts and require users to verify them before installation. 3. Cryptographically sign releases and document signature verification. 4. Avoid installation commands that automatically execute mutable remote package code where a download-and-verify workflow is available. 5. Use lockfiles and integrity metadata for all transitive Node.js dependencies involved in installation. 6. Document the exact audited revision in `README.md` and `SKILL.md`. 7. Recommend reviewing file changes before upgrading to a newer Skill release. 8. Protect maintainer and publishing accounts with phishing-resistant multi-factor authentication and restricted release permissions. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: errors.md:130
• Finding: Predictable shared temporary files permit symlink attacks and data exposure<![CDATA[ ## Vulnerability Details **File Location**: `errors.md:130-137`; `examples.md:193-199` **Vulnerability Type**: Unsafe predictable temporary-file handling **Risk Level**: Low ### Vulnerable Code `errors.md:130-137` ```bash HTTP_CODE=$(curl -s -o /tmp/response.json -w "%{http_code}" "$url" \ -H "X-Agent-Wallet-Address: $HEADER_WALLET" \ -H "X-Agent-Chain-Id: $HEADER_CHAIN_ID" \ -H "X-Agent-Timestamp: $HEADER_TIMESTAMP" \ -H "X-Agent-Nonce: $HEADER_NONCE" \ -H "X-Agent-Signature: $HEADER_SIGNATURE" \ -D /tmp/response_headers.txt) ``` `examples.md:193-199` ```bash HTTP_CODE=$(make_authenticated_request_capture \ "/api/agents/v1/me/pack-opening/${TX_HASH}" \ "chainId=${CHAIN_ID}" \ /tmp/recap.json) if [ "$HTTP_CODE" = "200" ]; then jq . /tmp/recap.json ``` ### Technical Analysis The examples write authenticated API responses and HTTP headers to fixed names in the globally shared `/tmp` directory. Predictable paths can collide across concurrent executions and may be pre-created by another local user or process. If a target is a symbolic link and the invoked utility follows it, output may be redirected to another file writable by the victim. Weak default permissions or a permissive `umask` can also allow other local users to read wallet-associated responses. Concurrent runs may overwrite each other's data, causing incorrect transaction status or recap information to be presented. The affected response data may include wallet addresses, collection inventory, pack-opening results, transaction identifiers, and rate-limit metadata. The examples do not create a private temporary directory, verify file ownership, set restrictive permissions, or guarantee cleanup. ### Attack Path 1. An attacker predicts one of the fixed paths, such as `/tmp/response.json` or `/tmp/recap.json`. 2. Before the victim runs the example, the attacker creates a conflicting file or symbolic link at that path. 3. The victim executes the documented command with ...[truncated 1043 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create a private temporary directory with `mktemp -d` instead of fixed paths. 2. Set `umask 077` before creating files containing authenticated responses. 3. Register a cleanup trap so temporary data is removed on normal exit and interruption. 4. Quote every generated path and verify that temporary-file creation succeeded. 5. Do not reuse the same temporary path across concurrent requests. 6. Avoid following pre-existing links by relying on securely and atomically created files. 7. Store sensitive response content in shell variables or pipes when a temporary file is unnecessary. Example hardened pattern: ```bash umask 077 TMP_DIR="$(mktemp -d)" || exit 1 trap 'rm -rf -- "$TMP_DIR"' EXIT HUP INT TERM RESPONSE_FILE="$TMP_DIR/response.json" HEADERS_FILE="$TMP_DIR/response_headers.txt" HTTP_CODE=$(curl -s \ -o "$RESPONSE_FILE" \ -D "$HEADERS_FILE" \ -w "%{http_code}" \ "$url" \ -H "X-Agent-Wallet-Address: $HEADER_WALLET" \ -H "X-Agent-Chain-Id: $HEADER_CHAIN_ID" \ -H "X-Agent-Timestamp: $HEADER_TIMESTAMP" \ -H "X-Agent-Nonce: $HEADER_NONCE" \ -H "X-Agent-Signature: $HEADER_SIGNATURE") ``` ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (16)

Ae1

High

• Category: analysis-evasion

Content

See [errors.md](./errors.md) for all error codes and troubleshooting.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

See [errors.md](./errors.md) for all error codes and troubleshooting.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: The README instructs users to install the skill via `npx skills add signorcrypto/deck0-skills` without pinning a specific package version or commit. This creates a supply-chain risk: a later compromised or maliciously updated package/tooling release could be fetched and executed implicitly, which is especially concerning for a skill that interfaces with wallets and on-chain transactions.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill advertises pack purchases and pack opening through smart contract transactions but does not prominently warn that these actions may spend funds and be irreversible once signed and broadcast. In the context of an agent skill, missing consent and risk language increases the chance that a user authorizes unintended financial actions without understanding the consequences.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill description is broad enough to match generic requests about collecting cards, managing collections, or creating card collections, which can cause the agent to invoke this transactional NFT/crypto skill when the user did not intend to access DECK-0 specifically. Because the skill supports authenticated API calls and on-chain purchase/open actions, accidental activation can expose wallet-linked data, initiate sensitive flows, or steer users into unintended crypto transactions.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation provides a fallback mode that directly uses a private key from an environment variable for request signing. While common in developer examples, embedding this pattern in a skill that may run in agent environments increases the chance of unsafe key handling, accidental logging, or reuse of a hot wallet without clearly warning that the credential grants signing authority.

External Transmission

Medium

• Category: Data Exfiltration

Content

local signature
  signature="$(cast wallet sign --private-key "$DECK0_PRIVATE_KEY" "$payload")"

  # Export for use in curl
  HEADER_WALLET="$WALLET"
  HEADER_CHAIN_ID="$DECK0_CHAIN_ID"
  HEADER_TIMESTAMP="$timestamp"

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The pack-opening recap endpoint returns transaction-linked results, cards received, guild-related badge information, and a collector identifier, all tied to an authenticated user. The markdown description does not warn that polling and displaying this data may expose sensitive activity or identity-linked collection information.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: These sections describe reading and submitting publisher application data including wallet address, collection description, motivational letter, rejection reason, and timestamps. The markdown omits any warning that this is user-submitted profile/application content that may be sensitive and should be handled carefully.

External Transmission

Medium

• Category: Data Exfiltration

Content

The `X-Agent-*` headers in the example below should be produced via the same auth flow as in [auth.md](./auth.md) (e.g. `sign_request` and the authenticated request helpers).

```bash
HTTP_CODE=$(curl -s -o /tmp/response.json -w "%{http_code}" "$url" \
  -H "X-Agent-Wallet-Address: $HEADER_WALLET" \
  -H "X-Agent-Chain-Id: $HEADER_CHAIN_ID" \
  -H "X-Agent-Timestamp: $HEADER_TIMESTAMP" \

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The example instructs the agent or user to execute a value-bearing blockchain transaction with a private key and computed `--value`, but it does not explicitly warn that real funds will be spent and the action is irreversible once broadcast. In an agent-skill context, examples often become implementation templates, so omitting a spending confirmation step increases the chance of unintended financial loss or autonomous execution against a live wallet.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The pack-opening example signs and submits an on-chain transaction using a private key but does not clearly state that the action is irreversible and changes ownership state of user assets. Even though it may not transfer currency directly, it affects owned packs and can trigger unintended asset changes if copied blindly by an agent or operator.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document instructs users how to perform payable on-chain purchases and irreversible pack-opening operations, but it does not prominently warn that minting spends native tokens plus gas and that opening packs is an irreversible state-changing transaction. In an agent skill context, this omission can cause users or downstream automation to authorize transactions without fully understanding financial cost and asset consequences.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The shell example directly relies on a raw private key in an environment variable and passes it to command-line tooling without any accompanying security guidance. In practice, this encourages unsafe key handling patterns that can lead to credential leakage through shell history, process inspection, logs, CI systems, or copied scripts, enabling full wallet compromise and unauthorized transactions.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The README describes wallet-authenticated API requests and submission of publisher applications, but it does not clearly disclose what wallet-linked data, signatures, addresses, or application contents are sent to the DECK-0 service. Because the skill ties identity and activity to a blockchain wallet, inadequate privacy notice can expose users to unintended data sharing and profiling risks.

Missing User Warnings

Low

• Confidence: 85% confidence
• Finding: This markdown file documents authenticated endpoints that return a user's wallet-specific album collection and account share URL, but it does not include any warning about exposing personal account or collection data. Under the markdown criteria for SQP-2, descriptions should warn when behavior can affect user privacy or reveal user-linked data.

Static analysis

No suspicious patterns detected.