Security audit

Tokenbroker

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly about token launch preparation, but it has credential, install, and production-network defaults that users should review carefully before installing.

Review this skill before installing. Use a pinned, verified installer; avoid exporting real GitHub tokens into installer commands; prefer testnet-only configuration; do not put wallet private keys in a plaintext .env unless you understand the risk; and require explicit confirmation before any nad.fun upload, mainnet preparation, or downstream token deployment.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: SETUP.md:8
Finding: Unpinned packages are downloaded and executed through npx
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: src/generators/nadfun.ts:75
Finding: Caller-controlled fields are interpolated into SVG markup without escaping
Content: View full analysis
${displayTicker} ${dis ...[truncated 4197 chars]
Remediation: View remediation
/g, '>') .replace(/"/g, '"') .replace(/'/g, '''); } ``` 2. Validate token names and tickers with strict allowlists and length limits: ```ts const SAFE_TOKEN_TEXT = /^[A-Z0-9 _.-]{1,32}$/; ``` 3. Validate colors as complete hex values rather than accepting arbitrary CSS: ```ts const SAFE_COLOR = /^#[0-9A-Fa-f]{6}$/; ``` 4. Reject control characters, markup delimiters, URLs, and unsupported Unicode formatting controls. 5. Build SVG through a trusted XML DOM or templating library that performs contextual escaping. 6. Pass the completed SVG through a maintained SVG sanitizer configured to remove scripts, event handlers, external references, foreign objects, animation-based abuse, and unsafe namespaces. 7. Configure the image host to serve uploads with restrictive headers, including a dedicated image origin, `Content-Security-Policy`, and `X-Content-Type-Options: nosniff`. 8. Add tests using malicious values in every interpolated field and verify that the resulting SVG remains structurally inert. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: src/generators/nadfun.ts:178
Finding: Production nad.fun endpoints are selected by default despite documented testnet safety default
Content: View full analysis
{ const baseUrl = NAD_API[network]; ``` The same default is repeated in the other exported network operations: ```ts export async function uploadMetadata( identity: IdentityOutput, imageUri: string, network: 'mainnet' | 'testnet' = 'mainnet' ): Promise { const baseUrl = NAD_API[network]; ``` ```ts export async function mineSalt( name: string, network: 'mainnet' | 'testnet' = 'mainnet' ): Promise { const baseUrl = NAD_API[network]; ``` ```ts export async function prepareLaunch( identity: IdentityOutput, network: 'mainnet' | 'testnet' = 'mainnet' ): Promise { ``` ```ts export async function quickPrepare( identity: IdentityOutput, network: 'mainnet' | 'testnet' = 'mainnet' ): Promise { return prepareLaunch(identity, network); } ``` This contradicts `SKILL.md:29-31`: ```md ### Testnet Mode - Default operation is on **testnet** for safety - Mainnet requires explicit configuration - Always review transactions before signing ``` It also conflicts with the default declared in `METADATA.md:19-22`: ```yaml - name: NETWORK description: Network to deploy to (mainnet or testnet) optional: false default: testnet ``` ### Technical Analysis All exported nad.fun operations use `mainnet` as the default when the caller omits the network argument. This violates the documented security model in which testnet is the default and mainnet ...[truncated 2114 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (31)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · METADATA.md (reported line 12)May include surrounding context.
yaml
requiredEnvironmentVariables: - name: GITHUB_TOKEN description: GitHub Personal Access Token for repository scanning (stored locally in .env) optional: false - name: PRIVATE_KEY description: EVM private key for wallet operations (stored locally, never exposed externally)

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · METADATA.md (reported line 33)May include surrounding context.
yaml
securityNotes: - All secrets stored locally in .env file - No external data transmission of credentials - Supports testnet mode for safe testing - Uses standard EVM wallet signing

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The setup guide explicitly recommends use of a GitHub Personal Access Token via export GITHUB_TOKEN=ghp_your_token_here. PATs are highly sensitive credentials, and placing them in shell environment variables before running unpinned package code raises the risk of token exposure through process inspection, shell history mishandling, malicious child processes, or package compromise.
Content: Scanner excerpt · SETUP.md (reported line 50)May include surrounding context.
npx clawhub install tokenbroker --github --device

text
**Option C: Personal Access Token** ```bash export GITHUB_TOKEN=ghp_your_token_here npx clawhub install tokenbroker

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The description presents an end-to-end skill that analyzes repos, generates token branding/promotion, and launches on nad.fun. In the provided code, the main implemented behavior is orchestration of already-analyzed repo data into identity, reasoning, and promo outputs. The input requires a precomputed repoAnalysis object, so no GitHub analysis occurs here. Although nad.fun launch-related functions are imported and re-exported, generateAll does not call them, and no actual launch/upload/mining behavior is executed in this chunk. Therefore the code only partially matches the description and overstates the implemented capabilities in this specific supplied code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The supplied code is focused narrowly on nad.fun token launch preparation. It generates token artwork, uploads image and metadata to nad.fun endpoints, and requests salt mining. The header comment explicitly says on-chain deployment is handled elsewhere ('deploy.ts'), so this chunk does not itself launch a token on-chain. Also, nothing in the code analyzes GitHub projects or repositories, despite that being part of the declared description. Therefore the description overstates and misstates this chunk’s actual behavior in material ways.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 84% confidence
Finding: The skill explicitly references local storage and generation of sensitive secrets in a .env file, including private keys and API tokens. Even though local storage is common, encouraging plaintext secret aggregation in a single file is risky in an agentic environment because compromise of the workspace, logs, backups, or accidental file exposure can leak credentials that enable wallet abuse and API misuse.
Content: Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.
md
- No credentials are transmitted to external servers beyond their intended endpoints (GitHub API, nad.fun API, Monad RPC) - The skill operates entirely within your local environment ### .env File Generation - The Install Wizard generates a `.env` file on your local machine - This file is **never committed** to version control (gitignored) - You can review and edit it at any time

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file presents the skill as only generating metadata proposals, yet it declares sensitive operational secrets such as an EVM private key and nad.fun API credentials. That mismatch can mislead operators and downstream agents about the skill’s real capabilities and trust boundary, increasing the chance that high-risk credentials are provisioned unnecessarily or to the wrong component.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The security note claims credentials are never exposed externally, but the described workflow includes authenticated API calls and blockchain signing for token launch. Even if raw secrets are not transmitted, authenticated operations derived from them are sent off-host, so the statement is materially misleading and may cause users to underestimate operational risk.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The activation phrases "scan this project" and "analyze this codebase" are very broad and likely to match common user requests outside the narrow token-launch workflow. This can cause the skill to activate in contexts where a user only wants generic repository analysis, unintentionally routing the agent into project-scanning and downstream token-generation behaviors.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The setup instructions execute npx clawhub install tokenbroker without pinning a specific package version. npx fetches the latest published package at runtime, so a compromised publisher account, dependency confusion, or malicious update could cause arbitrary code execution on the user's machine during installation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: This command invokes npx clawhub install tokenbroker --github without version pinning, which means users will execute whatever version is current at install time. In a security-sensitive setup flow that may later request GitHub authorization, this increases supply-chain risk because a malicious or hijacked release could harvest tokens or execute arbitrary code.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The device-code install path still relies on an unpinned npx clawhub invocation. Because npx resolves and runs remote code dynamically, an attacker controlling the package or its dependencies could compromise the workstation before or during authentication steps.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The Personal Access Token flow compounds the unpinned npx clawhub risk because it encourages setting GITHUB_TOKEN immediately before running remote package code. A malicious package version could read the environment variable and exfiltrate the token, making this context more dangerous than a generic unpinned install command.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SETUP.md (reported line 109)May include surrounding context.

Verify GitHub access:

bash
curl -H "Authorization: token $GITHUB_TOKEN" https://api.github.com/user

Test project scanning:

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: npx tokenbroker scan ./my-project is another unpinned runtime package execution. Even though this appears to be a post-install test command, it still creates a supply-chain execution point where a malicious or substituted package could run arbitrary code against the local repository and environment.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill documents network-capable behavior such as GitHub API access, nad.fun API calls, and RPC interaction, but it does not declare any explicit tool scope or allowed-tools restrictions. In an agent environment, missing capability boundaries can let the host grant broader network access than users expect, increasing the chance of unintended outbound requests or misuse of credentials.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill includes mainnet deployment instructions and contract invocation examples without a prominent warning that blockchain transactions are irreversible and may cause real financial loss. In the context of a token-launching skill, that omission is more dangerous because users may copy deployment steps directly and underestimate the operational and financial risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The meme-category description uses explicit promotional investment language such as 'moon-sized gains' and 'moonshots' without any qualification, risk disclosure, or neutrality. In this skill’s context, the generator is specifically used to create token branding and launch materials, so the text can directly encourage speculative investment behavior and expose users or operators to consumer-protection, platform-policy, and financial-promotion compliance risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code performs a network POST to the nad.fun API containing image data derived from user inputs, but the function has no confirmation prompt or user-facing warning about sending that content off-system. For code files, network calls that transmit user or system data should have some visible disclosure unless clearly covered elsewhere in the skill description.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The function sends token metadata including name, description, image URI, and symbol to a remote nad.fun endpoint, but there is no confirmation prompt or explicit warning that this data will be transmitted externally. Although the file comments describe the behavior for developers, that is not a clear user-facing disclosure for a safety-relevant network operation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The code comments say category is detected from repository analysis, but generateXThread passes reasoning cast as RepoAnalysis into detectCategory. This type-confusion bypasses the intended data source and can misclassify projects or manufacture category-based marketing from arbitrary reasoning text, undermining analysis integrity and making deceptive output easier.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The promotional templates contain investment-style hype such as 'to the moon,' 'don't miss out,' and fairness/community claims without risk disclosure or substantiation. In a token-launch skill, this is more dangerous than ordinary marketing because it can facilitate misleading financial promotion, encourage reckless user behavior, and create compliance and fraud exposure.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The exported promo generator ignores the provided repoAnalysis input entirely, even though the skill claims repository analysis informs token and promotional content. In this context, that creates integrity and trust issues: users may believe output is grounded in actual project characteristics when it is instead generated from generic identity/reasoning fields, enabling misleading or fabricated promotion.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The module is explicitly designed to generate an 'Investment Thesis' but contains no warning that the resulting content may be speculative, promotional, or financially sensitive. In a token-launch workflow, omission of disclosure can facilitate users treating autogenerated marketing text as investment guidance, increasing consumer-harm and compliance risk.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · src/generators/reasoning.ts (reported line 54)May include surrounding context.
ts
], ai: [ "AI development and deployment remains centralized, with users unable to access or profit from valuable machine learning models.", "On-chain AI agents lack the infrastructure to autonomously execute complex strategies while maintaining transparency and trustlessness.", "The potential of AI in blockchain ecosystems remains largely untapped, with no robust framework for AI-powered governance or automation." ], nft: [

Static analysis

No suspicious patterns detected.