ClawHub
Back to skill

Security audit

spawnxchange-agentcash

Security checks for vulnerabilities and agentic risk

Overview

This skill is a clearly disclosed walkthrough for using a wallet-backed marketplace, with meaningful financial and source-code handling risks users should manage deliberately.

Install only if you intend to use AgentCash for USDC marketplace transactions. Use a dedicated low-balance wallet, verify the AgentCash package before installing it globally or as an MCP server, set max spend amounts from the displayed item price, and package only files you are comfortable uploading and potentially exposing.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:109
Finding
Security-Critical Wallet Dependency Installed Without Artifact Integrity Verification## Vulnerability Details **File Location**: `SKILL.md`, lines 109–114 and 130 **Vulnerability Type**: Third-party dependency and software supply-chain risk **Risk Level**: Medium **Vulnerable code:** ```bash npm install -g agentcash@0.17.1 agentcash --version ``` ```bash agentcash onboard <CODE> ``` ```bash claude mcp add agentcash --scope user -- npx -y agentcash@0.17.1 ``` ### Technical Analysis The Skill directs the operator to install and execute the npm-distributed `agentcash` package globally or execute it through `npx`. Although the package version is pinned, the instructions do not verify a cryptographic digest, signed release, package provenance, or publisher identity before execution. Version pinning prevents accidental upgrades but does not protect against compromise of the pinned registry artifact, maintainer account, publication infrastructure, or npm delivery channel. This dependency is particularly security-sensitive because it creates and operates a funded cryptocurrency wallet, signs marketplace requests, and may run as a user-scoped MCP server. The global installation and user-scoped MCP configuration also give the dependency a broader execution lifetime and scope than a one-time, isolated marketplace request requires. No malicious behavior by the named package was established during this audit; the confirmed issue is the absence of integrity controls around a privileged dependency. ### Attack Path 1. An attacker compromises the npm package, its maintainer account, or the package-delivery infrastructure. 2. The operator follows the Skill and runs `npm install -g agentcash@0.17.1` or `npx -y agentcash@0.17.1`. 3. npm downloads and executes package installation or runtime code without an independent integrity or provenance check specified by the Skill. 4. The compromised package executes with the operator's user privileges. 5. It can target wallet state, alter signing or payment beha ...[truncated 902 chars]
Remediation
## Remediation Suggestions 1. Publish an authoritative SHA-256 digest or another independently verifiable integrity value for the exact package artifact. 2. Require verification of npm provenance or signed release attestations before installation. 3. Clearly document the authoritative npm package name, publisher identity, source repository, and release verification procedure. 4. Prefer a locked local installation over a global installation, and use a lockfile with integrity metadata. 5. Avoid `npx -y` for a wallet-capable MCP service unless the retrieved artifact is independently verified first. 6. Run the wallet component in a sandbox or dedicated low-privilege account with restricted filesystem and network access. 7. Use a dedicated low-balance wallet and retain strict transaction limits to reduce the effect of dependency compromise. 8. Document how users can inspect the installed package and compare it with the corresponding reviewed source release.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:378
Finding
Base64-Encoded Source Archive Exposed Through Process Arguments## Vulnerability Details **File Location**: `SKILL.md`, lines 378–384 **Vulnerability Type**: Sensitive data exposure through command-line arguments **Risk Level**: Medium **Vulnerable code:** ```bash agentcash fetch "$SX/api/v1/items" \ -m POST -H "Content-Type: application/json" \ -b "$(cat ./listing-body.json)" \ --payment-protocol x402 --payment-network "$NETWORK" --max-amount 0.05 ``` ### Technical Analysis `listing-body.json` contains the complete marketplace request, including the source archive encoded as base64. The command substitution expands the entire file and supplies it as the value of the `-b` command-line argument. Command-line arguments are not an appropriate channel for confidential or proprietary source content. Depending on the operating system and local environment, process arguments may be exposed through process inspection interfaces, diagnostic collectors, endpoint monitoring, shell tracing, crash reports, audit systems, or command telemetry. Base64 is an encoding rather than encryption, so an observer can directly decode the captured archive. Uploading a deliberately selected archive to SpawnXchange is necessary for the declared selling functionality. Exposing the same archive through the local process argument vector is not necessary and exceeds the minimum data exposure required to perform that upload. ### Attack Path 1. The seller prepares `listing-body.json`, which contains the complete base64-encoded artifact. 2. The seller executes the documented `agentcash fetch` command. 3. The shell evaluates `$(cat ./listing-body.json)` and inserts the complete JSON document into the child process's argument vector. 4. A local process observer, monitoring product, diagnostic mechanism, or audit collector captures the command-line arguments while the process is running or from retained telemetry. 5. The observer extracts the `file` field and base64-decodes it. 6. The observer recovers the ...[truncated 944 chars]
Remediation
## Remediation Suggestions 1. Add support to AgentCash for reading an HTTP body from standard input or directly from a file. 2. Replace the argument-based body with an interface such as `--body-file ./listing-body.json` or a stdin-based equivalent. 3. Ensure the client streams the body without copying it into process arguments, environment variables, shell history, or diagnostic logs. 4. Until a safe body-input mechanism is available, explicitly state that this upload workflow must not be used for confidential or commercially sensitive artifacts. 5. Preserve the existing archive-content review guidance and add checks for restrictive file permissions on `listing-body.json`. 6. Delete the temporary request body securely when it is no longer required, subject to the limitations of the underlying filesystem. 7. Recommend disabling shell tracing and reviewing endpoint telemetry policies before handling proprietary archives.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.