T03 · Remote Payload Retrieval and Execution
Error
- Location
scripts/01_install_cast.sh:19- Finding
Unverified Remote Installer Is Piped Directly into Bash
- Content
View full analysis
- Remediation
View remediation
Security audit
Cast
Security checks for vulnerabilities and agentic risk
Overview
This wallet skill has a coherent purpose, but it handles crypto secrets in unsafe ways and makes broad local/system changes that need careful review before installation.
Install only after reviewing the scripts and understanding that this skill can handle complete wallet-control secrets. Do not use it with wallets holding meaningful funds; prefer a hardware wallet or separate signer, avoid importing existing seed phrases, decline unverified remote installers and sudo package changes, and delete ~/.agent-wallet plus any workspace transaction logs if you test it.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (7)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/03_password.sh:19- Finding
Encrypted Keystore and Plaintext Decryption Password Are Persisted Together
- Content
View full analysis
"${PASSWORD_FILE}" chmod 600 "${PASSWORD_FILE}" || true ok "Password saved to ${PASSWORD_FILE}" cp -f "$candidate" "${KEYSTORE_FILE}" chmod 600 "${KEYSTORE_FILE}" || true ok "Keystore saved to ${KEYSTORE_FILE}" ADDRESS="$(cast wallet address --keystore "${KEYSTORE_FILE}" --password-file "${PASSWORD_FILE}")" ``` ### Technical Analysis The script persistently stores both the encrypted keystore and its plaintext decryption password under `~/.agent-wallet`. This defeats the primary security boundary provided by keystore encryption: any process capable of reading the directory can obtain both the ciphertext and the credential needed to decrypt it. Mode `0600` limits access to the owning account but does not protect against malware running as that user, compromised agent tools, backup or snapshot exposure, accidental archive inclusion, or account-level compromise. The documentation mandates this behavior without offering an opt-out. ### Attack Path 1. The user completes wallet onboarding. 2. The script writes `keystore.json` and `pw.txt` into the same user-controlled directory. 3. An attacker obtains read access as the user, through malware, a compromised tool, backup access, or another account-level weakness. 4. The attacker copies both files. 5. The plaintext password unlocks the copied keystore. 6. The attacker signs and broadcasts unauthorized transactions. ### Impact Assessment Read access to `~/.agent-wallet` can become complete c ...[truncated 197 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/02_wallet.sh:180- Finding
Mnemonic and Private Key Material Are Written to Plaintext Files
- Content
View full analysis
"${MNEMONIC_FILE}" chmod 600 "${MNEMONIC_FILE}" || true ok "Recovery words saved to ${MNEMONIC_FILE}" cleanup_note="$(schedule_mnemonic_file_cleanup "${MNEMONIC_FILE}")" warn "Mnemonic file will be deleted in ~1 hour (${cleanup_note})." else warn "Could not automatically capture the mnemonic from cast; please record it securely now." fi fi if ! [[ "$PRIVATE_KEY" =~ ^0x[0-9a-fA-F]{64}$ ]]; then err "Private key format invalid." exit 1 fi printf "%s" "${PRIVATE_KEY}" > "${PK_TMP}" chmod 600 "${PK_TMP}" || true ok "Wallet material prepared." warn "A temporary private key file was created: ${PK_TMP}" dim "Step 03 will encrypt it into a keystore and then delete this temp file." ``` ### Technical Analysis The generated mnemonic is stored unencrypted for approximately one hour. If scheduler installation or job creation fails, it may remain indefinitely until manually removed. The raw private key is also written to a temporary file and persists until the next onboarding stage successfully deletes it. An interruption, crash, power loss, or failed keystore import leaves the private key behind. Ordinary `rm` deletion does not guarantee removal from backups, snapshots, filesystem journals, copy-on-write storage, or prior disk blocks. ### Attack Path 1. The user generates or imports wallet material. 2. The script writes the mnemonic and private key to files under `~/.agent-wallet`. 3. An attacker or compromised process monitors, reads, snapshots, or backs up that directory during the exposure window. 4. On interrupted onboarding, the private-key file rema ...[truncated 485 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/03_password.sh:45- Finding
Wallet Secrets Are Exposed Through Process Arguments and Environment Variables
- Content
View full analysis
/dev/null 2>&1; then printf "" return 0 fi local out set +e out=$(cast wallet derive --mnemonic "$mnemonic" --hd-path "$hdpath" 2>/dev/null || true) if [[ -z "$out" ]]; then out=$(cast wallet derive "$mnemonic" --hd-path "$hdpath" 2>/dev/null || true) fi ``` ### Technical Analysis The mnemonic and private key are passed as command-line arguments, while the password is supplied through `CAST_UNSAFE_PASSWORD`. Command arguments and process environments can be captured by operating-system process inspection, audit frameworks, debugging tools, crash diagnostics, monitoring agents, or privileged local processes. The private key and password are supplied to the same child process, so observation of that process may disclose enough information to control the wallet immediately. Suppressing standard error does not mitigate process metadata exposure. ### Attack Path 1. The user imports a mnemonic or creates the encrypted keystore. 2. The script starts `cast` with wallet secrets in its argument list and environment. 3. A local monitoring process, privileged user, diagnostic agent, or compromised tool records process metadata. 4. The attacker extracts the mnemonic, private key, or password. 5. The attacker recreates or unlocks the wallet and signs unauthorized transactions. ### Impact Assessment Captured mnemonic or private-key data ...[truncated 229 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/00_lib.sh:108- Finding
Writable State Data Is Executed as Shell Code
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/02_wallet.sh:41- Finding
Wallet Setup Attempts Privileged Installation of a System Scheduler
- Content
View full analysis
/tmp/at-install.log 2>&1"; then warn "Failed to install 'at' with sudo; mnemonic cleanup will be manual." return 1 fi else if ! sh -c "$installer > /tmp/at-install.log 2>&1"; then warn "Failed to install 'at'; mnemonic cleanup will be manual." return 1 fi fi hash -r if has_cmd at; then ok "Installed 'at' so mnemonic cleanup can be scheduled." return 0 fi warn "Installation succeeded but 'at' still unavailable; cleanup will be manual." return 1 } ``` ### Technical Analysis Wallet creation attempts to install the system-wide `at` scheduler merely to delete a plaintext mnemonic after one hour. This exceeds the minimum privileges necessary for wallet onboarding and can install or activate a persistent operating-system service. The command may invoke `sudo`, causing administrative package installation without a separate, explicit explanation of the system-wide change. Wallet removal deletes wallet files but does not uninstall the package or disable any service introduced by this step. ### Attack Path 1. The user creates a wallet on a system without `at`. 2. The script detects `apt` or `apt-get`. 3. The script invokes `sudo sh -c` to install the package. 4. The package manager makes system-wide changes and may enable a scheduler service. 5. Those changes remain after walle ...[truncated 363 chars]- Remediation
View remediation
T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:28- Finding
Skill Instructions Reduce Transparency Around Security-Sensitive Operations
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (32)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
The script downloads installer code directly from a remote URL and executes it locally without verifying a checksum, signature, or pinned version. If the remote endpoint, transport path, or hosting account is compromised, arbitrary code will run on the user's machine during installation.
- Content
sh exit 0 fi if ! has_cmd curl; then err "curl is required but not found. Install curl and re-run." exit 1 fi warn "cast not found. Installing Foundry..."
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
Using
curl ... | bashcreates a direct command-execution chain from network input to the shell, eliminating any opportunity for integrity validation before execution. This makes compromise of the download source or a malicious response immediately equivalent to arbitrary code execution on the host.- Content
sh exit 1 fi warn "cast not found. Installing Foundry..." curl -L https://foundry.paradigm.xyz | bash enable_strict_path if ! has_cmd foundryup; then for p in "${HOME}/.bashrc" "${HOME}/.zshrc" "${HOME}/.profile"; do
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script passes the raw private key as a command-line argument to 'cast wallet address --private-key', which can expose the secret through process listings, shell history wrappers, audit logs, or telemetry on multi-user systems. This directly contradicts the script's claim that the key will not be printed back and is especially dangerous because the file is explicitly handling highly sensitive wallet material.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill instructs the agent to read and write local files and run shell scripts, but it declares no explicit tool scope or permission boundaries. That creates an overbroad execution surface where wallet secrets, workspace files, and shell access can be used without an auditable least-privilege contract.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill expands beyond wallet operations into updating TOOLS.md, which is outside its stated functional scope. Scope expansion increases the chance of unintended workspace modification and can be abused to persist misleading or sensitive information in unrelated documentation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill presents token metadata assets as authoritative reference data, then later instructs the agent to modify those same JSON assets during onboarding. Allowing runtime mutation of reference assets can poison future decisions, persist untrusted token data, and blur the line between trusted configuration and user-supplied input.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 95% confidence
- Finding
The skill explicitly persists a keystore, password stash, and network/token state across sessions as part of onboarding. Persisting wallet credentials and related state in agent-accessible local storage materially increases the blast radius of compromise, especially in an environment with shell and file-write capabilities.
- Content
md ## Scripts - **Step scripts** — `scripts/01_install_cast.sh`..`06_finish.sh` cover the onboarding flow described in the README: install Foundry/cast, create or import a key, encrypt the keystore, choose network/RPC/tokens (sourced from the JSON assets), and show the resulting address and balance. Run them in order when the user requests onboarding. Each script already prompts for the necessary inputs (mnemonic/private key, password, RPC URL, token details), so relaying the same questions to the user and then running the next script is the recommended approach. - **Wallet health check** — `scripts/check_wallet.sh` inspects the shared state and reports whether a keystore/address pair already exists; it returns success (0) when a wallet is present and 1 otherwise. - **Network status** — `scripts/show_network.sh` prints the active network name, chainId, and RPC URL from `~/.agent-wallet/state.env`, or warns if the configuration is incomplete. - **Wallet removal** — `scripts/remove_wallet.sh` safely deletes the keystore, password stash, and metadata from `~/.agent-wallet/state.env` after an explicit confirmation.
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The instruction is written as a mandatory communication directive in Russian and tells the agent how to speak with the user, but it does not offer a language choice or indicate that the user opted into Russian. This is a natural-language locale policy issue because it imposes a specific language behavior without documented justification or consent.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
The skill directs the agent to run readiness checks and reveal stored wallet status, keystore path, network details, and balances automatically each session without asking the user. Automatically surfacing sensitive local state increases the chance of unintended disclosure and normalizes agent-initiated actions on a high-risk wallet environment.
- Content
md Always ask the user, right before running each script, exactly the question that script itself will ask (password, network choice, etc.). Do not invent or fill in answers on their behalf—only use the information they explicitly provide. This keeps onboarding faithful to what they chose and avoids pushing the scripts forward with made-up data. 1. **Start with targeted help if stuck.** Pipe `cast --help` through `grep` (e.g., `cast --help | grep balance`) to zero in on the relevant subcommand and avoid scrolling the entire manual; this saves tokens and keeps the answer focused before you proceed or explain anything. 2. **Automatic readiness check.** Run `scripts/check_wallet.sh` automatically each session; do not ask the user to trigger it. If it detects an existing wallet, immediately display the saved address/keystore path and proceed to show the balance/network status (see next step) so the user sees “wallet ready” without extra probes. 3. **Show wallet + network status.** When `check_wallet` finds a wallet, run `scripts/show_network.sh` and query the balance (e.g., `cast balance <ADDRESS> --rpc-url <RPC_URL> --ether`) so the user sees the current native balance, network name, chainId, and RPC URL without being prompted to check anything manually. 4. **Onboarding flow** (automatic when no wallet exists). If the readiness check exits with 1, walk through the scripted steps in order, mirroring their prompts and explicitly asking the user for every required piece of information before running the next script. After the key-material step finishes, share the derived address immediately so the user sees it before we ask them for anything in step 3: 1. Installation — explain that the script will ensure Foundry/cast is installed so every mentioned `cast` command works before proceeding.
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 98% confidence
- Finding
The skill instructs the agent to collect highly sensitive key material, including mnemonics and private keys, and even save generated mnemonic words to a local file for an hour. In the context of an EVM wallet skill, this is especially dangerous because exposure of seed phrases or private keys enables complete and irreversible theft of funds across all derived accounts.
- Content
md 3. **Show wallet + network status.** When `check_wallet` finds a wallet, run `scripts/show_network.sh` and query the balance (e.g., `cast balance <ADDRESS> --rpc-url <RPC_URL> --ether`) so the user sees the current native balance, network name, chainId, and RPC URL without being prompted to check anything manually. 4. **Onboarding flow** (automatic when no wallet exists). If the readiness check exits with 1, walk through the scripted steps in order, mirroring their prompts and explicitly asking the user for every required piece of information before running the next script. After the key-material step finishes, share the derived address immediately so the user sees it before we ask them for anything in step 3: 1. Installation — explain that the script will ensure Foundry/cast is installed so every mentioned `cast` command works before proceeding. 2. Key material — before running the wallet step, ask whether they want to create a new hot keypair, import a 12/24-word MetaMask-compatible mnemonic (`m/44'/60'/0'/0/0`), or import a private key. Collect the chosen secret, confirm the resulting address right after the step finishes, and tell the user that address before moving on. When generating a new keypair, capture the mnemonic displayed by `cast wallet new`, save it to `~/.agent-wallet/mnemonic-words-<timestamp>.txt`, and tell the user the exact path plus the fact that a job (via `at now + 1 hour` if available or a background `sleep` fallback) will delete that file after 60 minutes so the seed phrase does not linger. 3. Password — only ask for the keystore password once (there is no confirmation prompt, no save/remember question, and the account name is forced to “agent”). The script saves that password to the local helper file and uses it when creating the keystore, so nothing else is needed from the user for this step. 4. Network — read aloud the default network list derived from `assets/evm-networks.json`, ask which numbered network they want, and note ...[truncated 25 chars]
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 94% confidence
- Finding
The onboarding flow authorizes the agent to perform consequential wallet actions automatically once the absence of a wallet is detected, including key generation/import handling, password persistence, network configuration, and token-state changes. In a cryptocurrency context, autonomous progression around secret material and persistent wallet setup is especially dangerous because mistakes can lead to irreversible loss or unauthorized state changes.
- Content
md 4. **Onboarding flow** (automatic when no wallet exists). If the readiness check exits with 1, walk through the scripted steps in order, mirroring their prompts and explicitly asking the user for every required piece of information before running the next script. After the key-material step finishes, share the derived address immediately so the user sees it before we ask them for anything in step 3: 1. Installation — explain that the script will ensure Foundry/cast is installed so every mentioned `cast` command works before proceeding. 2. Key material — before running the wallet step, ask whether they want to create a new hot keypair, import a 12/24-word MetaMask-compatible mnemonic (`m/44'/60'/0'/0/0`), or import a private key. Collect the chosen secret, confirm the resulting address right after the step finishes, and tell the user that address before moving on. When generating a new keypair, capture the mnemonic displayed by `cast wallet new`, save it to `~/.agent-wallet/mnemonic-words-<timestamp>.txt`, and tell the user the exact path plus the fact that a job (via `at now + 1 hour` if available or a background `sleep` fallback) will delete that file after 60 minutes so the seed phrase does not linger. 3. Password — only ask for the keystore password once (there is no confirmation prompt, no save/remember question, and the account name is forced to “agent”). The script saves that password to the local helper file and uses it when creating the keystore, so nothing else is needed from the user for this step. 4. Network — read aloud the default network list derived from `assets/evm-networks.json`, ask which numbered network they want, and note that the script now auto-selects the first RPC URL from that entry (it saves the matching `CHAIN_ID`/`ETH_RPC_URL` and then just shows the RPC so the user can see which endpoint is being used). 5. Tokens — the script now prints the token table derived from `assets/evm-network-tokens.json` so it appears directly i ...[truncated 25 chars]
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill requires persistent logging of wallet addresses, transaction hashes, and descriptions to a workspace file without user notice or consent. This creates a privacy and operational security risk because transaction history and wallet identifiers may be exposed to other tools, users, or future sessions.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Natural-language transaction logs can retain sensitive financial context, wallet identifiers, and operational intent in a durable workspace artifact. Because this data may be easier to search, copy, or leak than raw chain data, the logging requirement meaningfully increases disclosure risk.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
json "name": "Avalanche C-Chain", "chainId": 43114, "rpcUrls": [ "https://api.avax.network/ext/bc/C/rpc" ], "links": { "docs": "https://build.avax.network/docs/primary-network",
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
json "name": "Avalanche C-Chain", "chainId": 43114, "rpcUrls": [ "https://api.avax.network/ext/bc/C/rpc" ], "links": { "docs": "https://build.avax.network/docs/primary-network",
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh ensure_app_dir() { mkdir -p "${APP_DIR}" chmod 700 "${APP_DIR}" || true } state_init() {
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This shell library writes and updates persistent state under the user's home directory via state_init, state_set, and state_unset, including creating ~/.agent-wallet/state.env and overwriting its contents. Although the operations are permission-hardened, there is no user-facing disclosure, prompt, or warning in this file indicating that persistent local state will be created and modified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The add_custom_token_to_json function rewrites the target JSON file using json.dump(open(path, 'w'), ...), which can alter user-managed token configuration on disk. The function prints a success message after the write, but there is no warning or confirmation before performing the file modification.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script expands its scope from wallet management into host package management by attempting to install 'at' with apt and optionally sudo. In a wallet-handling workflow, that broader system modification is risky because it can trigger privilege escalation prompts, alter the host unexpectedly, and increases the blast radius if the script or environment is compromised.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
This line invokes sudo to run a shell command that installs a system package, giving the script a privileged execution path beyond its stated wallet-management purpose. Even if intended for convenience, privileged package installation from within a wallet script increases trust requirements and can be abused or cause unintended host changes.
- Content
sh return 1 fi if [[ -x "/usr/bin/sudo" ]]; then if ! sudo sh -c "$installer > /tmp/at-install.log 2>&1"; then warn "Failed to install 'at' with sudo; mnemonic cleanup will be manual." return 1 fi
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh state_set "SAVE_PASSWORD" "y" umask 077 printf "%s" "$PW" > "${PASSWORD_FILE}" chmod 600 "${PASSWORD_FILE}" || true ok "Password saved to ${PASSWORD_FILE}" acct_name="agent" state_set "KEYSTORE_NAME" "${acct_name}"
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh state_set "SAVE_PASSWORD" "y" umask 077 printf "%s" "$PW" > "${PASSWORD_FILE}" chmod 600 "${PASSWORD_FILE}" || true ok "Password saved to ${PASSWORD_FILE}" acct_name="agent" state_set "KEYSTORE_NAME" "${acct_name}"
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh state_set "SAVE_PASSWORD" "y" umask 077 printf "%s" "$PW" > "${PASSWORD_FILE}" chmod 600 "${PASSWORD_FILE}" || true ok "Password saved to ${PASSWORD_FILE}" acct_name="agent" state_set "KEYSTORE_NAME" "${acct_name}"
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh state_set "SAVE_PASSWORD" "y" umask 077 printf "%s" "$PW" > "${PASSWORD_FILE}" chmod 600 "${PASSWORD_FILE}" || true ok "Password saved to ${PASSWORD_FILE}" acct_name="agent" state_set "KEYSTORE_NAME" "${acct_name}"
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
sh state_set "SAVE_PASSWORD" "y" umask 077 printf "%s" "$PW" > "${PASSWORD_FILE}" chmod 600 "${PASSWORD_FILE}" || true ok "Password saved to ${PASSWORD_FILE}" acct_name="agent" state_set "KEYSTORE_NAME" "${acct_name}"
Static analysis
No suspicious patterns detected.