ChaosChain ACE (Phase 0)

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:03 PM UTC
• Version: 0.1.0

Overview

This skill is a disclosed policy guide for bounded API payments, with a dependency-pinning caution but no hidden execution or exfiltration behavior found.

Install only if you are comfortable giving an agent tightly bounded authority to make x402 API payments. Set conservative max-per-transaction and daily limits, require short TTLs, restrict categories to compute/data/api, and pin the SDK and ethers to exact reviewed versions before using it in runtime code.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Mutable Dependency Versions in Wallet-Payment Integration Guidance

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-17
Vulnerability Type: Supply-chain exposure through mutable third-party dependency ranges
Risk Level: Medium

Complete Code Snippet:

markdown

Use this skill with `@chaoschain/ace-session-key-sdk` in runtime code.

SDK package (pin recommended):

```bash
npm install @chaoschain/ace-session-key-sdk@0.1.x ethers@6

text

### Technical Analysis

The installation command specifies mutable version ranges for both `@chaoschain/ace-session-key-sdk` and `ethers`. The `0.1.x` range can resolve to any matching patch release, while `@6` can resolve to later releases within the selected npm range semantics. Consequently, a future installation can retrieve dependency code that was not present during this audit.

This is particularly sensitive because the skill directs runtime code to use the SDK for bounded, wallet-funded session keys and autonomous x402 payments. Dependency code used in that trust boundary may process session-key material, payment challenges, transaction parameters, policy values, and network requests.

The reviewed file does not prove that either named package is currently malicious. The confirmed weakness is the non-reproducible dependency guidance and resulting exposure to future compromised, malicious, or unexpectedly incompatible releases.

### Attack Path

1. An attacker compromises a maintainer account, package-publishing workflow, npm distribution path, or another matching release in the dependency chain.
2. The attacker publishes malicious code under a version accepted by `0.1.x` or the `ethers@6` specification.
3. An operator follows the documented installation command after the malicious release becomes available.
4. npm resolves and installs the newly published matching version.
5. The application imports the dependency for session-key and payment processing.
6. Malicious dependency code executes with the application's p
...[truncated 987 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace version ranges with exact, reviewed versions, for example @chaoschain/ace-session-key-sdk@0.1.Z and an exact ethers release.
2. Commit a lockfile and require immutable or frozen-lockfile installation in development, CI, and production.
3. Verify npm package provenance and integrity metadata before deployment.
4. Audit direct and transitive dependencies, and use automated monitoring for advisories and unexpected ownership or publication changes.
5. Upgrade dependencies only through a controlled review process that reruns security tests and confirms lockfile changes.
6. Isolate payment processing and provide the SDK only the minimum required signing and network capabilities.
7. Enforce transaction amount, destination, category, daily-limit, and expiration constraints in a separately trusted layer or wallet policy rather than relying solely on dependency code.
8. Avoid exposing root wallet keys directly; use narrowly scoped, short-lived session keys with independently enforced spending limits.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.