Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed Monero wallet/payment skill that can move real funds, but its high-risk actions and credential handling are aligned with its purpose and mostly gated or documented.
Install only in a private, single-user environment. Keep wallet RPC bound to localhost or protected by HTTPS, never commit or back up the .env file with real secrets, test on stagenet first, and require human review before any --confirm send or sweep_all operation.
[[ -n "${MONERO_RPC_SSL_CACERT:-}" ]] && args+=(--cacert "$MONERO_RPC_SSL_CACERT")
[[ -n "${MONERO_RPC_SSL_CAPATH:-}" ]] && args+=(--capath "$MONERO_RPC_SSL_CAPATH")
}
curl "${args[@]}" -d "$body"
}
rpc_call() {Finding The skill clearly performs shell execution and file writes, including creating `.env`, `.netrc`, PID files, and launching `monero-wallet-rpc`, yet no declared permissions are documented. In an agent setting this weakens security boundaries because operators may approve or invoke the skill without understanding that it can persist secrets and start local processes. ### Context-Inappropriate Capability
Content NETRC_FILE="$dir/.netrc" Confidence
Content
@test "script_init exports MONERO_WALLET_PASSWORD from .env" {
d="$(mktemp -d)"; printf 'MONERO_NETWORK="mainnet"\nMONERO_RPC_URL="http://127.0.0.1:18099"\nMONERO_LOCK_DIR="%s"\nMONERO_WALLET_PASSWORD="secret123"\n' "$(mktemp -d)" > "$d/.env"
mkdir -p "$d/lib" "$d/scripts"
cp "$LIB"/*.sh "$d/lib/"Finding This test writes a wallet password to a temporary .env file, loads it into the environment, and then echoes the secret into test output. Even though the value is a dummy test password, the pattern normalizes unsafe secret-handling behavior and could leak real credentials if the test is adapted, copied, or run with non-test values in CI logs or developer consoles. ### Credential Access
Content # --- Write .env --- Confidence
shell_execution: true
file_writes:
- ".env (chmod 600) — RPC credentials + wallet password"
- "$MONERO_LOCK_DIR/.netrc (chmod 600) — ephemeral RPC auth"
- "$MONERO_LOCK_DIR/wallet-rpc.pid — process tracking"
- "$MONERO_LOCK_DIR/wallet-rpc.port — port tracking"
- "$MONERO_LOCK_DIR/.last_refresh — refresh timestamp"- "$MONERO_LOCK_DIR/.last_refresh — refresh timestamp"
process_management: "starts/stops monero-wallet-rpc as a background process"
network_access: "HTTP POST to $MONERO_RPC_URL/json_rpc (localhost by default)"
credential_access: "reads .env for RPC + wallet credentials; writes .netrc for curl auth"
---
# Agenta-Monero| Capability | Details | |------------|---------| | **Shell execution** | Runs `curl`, `jq`, `flock`, `monero-wallet-rpc`, and standard shell utilities | | **File writes** | `.env` (chmod 600), `.netrc` (chmod 600, ephemeral), PID/port files, lock files, refresh timestamp | | **Process management** | Starts and stops `monero-wallet-rpc` as a background daemon (PID tracked in `$MONERO_LOCK_DIR`) | | **Network access** | HTTP POST to `$MONERO_RPC_URL/json_rpc` (localhost by default; can be configured for remote) | | **Credential access** | Reads `.env` for RPC user/password and wallet password; writes `.netrc` for curl auth; never emits credentials in stdout |
| **File writes** | `.env` (chmod 600), `.netrc` (chmod 600, ephemeral), PID/port files, lock files, refresh timestamp | | **Process management** | Starts and stops `monero-wallet-rpc` as a background daemon (PID tracked in `$MONERO_LOCK_DIR`) | | **Network access** | HTTP POST to `$MONERO_RPC_URL/json_rpc` (localhost by default; can be configured for remote) | | **Credential access** | Reads `.env` for RPC user/password and wallet password; writes `.netrc` for curl auth; never emits credentials in stdout | All credential files are created with restrictive permissions (`0600` for files, `0700` for the lock directory). The `.env` file is parsed safely (never sourced) and shell metacharacters are rejected.
- **`validate_address` uses real RPC fields.** The RPC is called with `any_net_type:true` so the real `nettype` is returned; `network_match` is derived client-side by comparing `nettype` to `MONERO_NETWORK`. There is **no `checksum_valid` field** (the checksum is part of `valid`). This keeps `INVALID_ADDRESS` (bad format/checksum) distinct from `NETWORK_MISMATCH` (valid but wrong network). - **Money is integer piconeros (1 XMR = 10^12).** Never use floating-point for amounts. All arithmetic is integer piconero; the XMR decimal strings in output come from the scripts' string-based conversion. Amounts must be positive and have <=12 decimals. - **Sends and sweeps are not idempotent and are NOT auto-retried.** On timeout/uncertain result, check `get_transfer.sh --tx-hash` **before** retrying (see retry-safety workflow). Use `--dry-run` / `estimate_fee` to preview. - **Credentials use netrc (never `curl -u`); `.env` is parsed, never sourced.** The netrc lives at `$MONERO_LOCK_DIR/.netrc` (mode `0600`). All user values are passed to the RPC via `jq --arg`/`--argjson` — never by string interpolation. ## Workflows
permissions:
shell_execution: true
file_writes:
- ".env (chmod 600) — RPC credentials + wallet password"
- "$MONERO_LOCK_DIR/.netrc (chmod 600) — ephemeral RPC auth"
- "$MONERO_LOCK_DIR/wallet-rpc.pid — process tracking"
- "$MONERO_LOCK_DIR/wallet-rpc.port — port tracking"- "$MONERO_LOCK_DIR/.last_refresh — refresh timestamp"
process_management: "starts/stops monero-wallet-rpc as a background process"
network_access: "HTTP POST to $MONERO_RPC_URL/json_rpc (localhost by default)"
credential_access: "reads .env for RPC + wallet credentials; writes .netrc for curl auth"
---
# Agenta-MoneroRPC_USER=$(gen_random 12) RPC_PASSWORD=$(gen_random 24) # --- Resolve .env path --- ENV_FILE="$SCRIPT_DIR/../.env" if [[ -f "$ENV_FILE" && "$FORCE" != true ]]; then
RPC_PASSWORD=$(gen_random 24) # --- Resolve .env path --- ENV_FILE="$SCRIPT_DIR/../.env" if [[ -f "$ENV_FILE" && "$FORCE" != true ]]; then printf '%s' ".env already exists at $ENV_FILE — overwrite? [y/N] " >&2
[[ "$answer" =~ ^[yY] ]] || json_error "CONFIG_INVALID" "setup cancelled by user" fi # --- Write .env --- cat > "$ENV_FILE" <<EOF # === Monero Wallet RPC Connection === MONERO_RPC_URL="http://127.0.0.1:$RPC_PORT"
[[ -n "$pid" ]] && kill "$pid" 2>/dev/null || true # Verify .env was written [[ -f "$skill_copy/.env" ]] local env_contents env_contents=$(cat "$skill_copy/.env") [[ "$env_contents" == *"MONERO_NETWORK=\"stagenet\""* ]]
# Verify .env was written [[ -f "$skill_copy/.env" ]] local env_contents env_contents=$(cat "$skill_copy/.env") [[ "$env_contents" == *"MONERO_NETWORK=\"stagenet\""* ]] [[ "$env_contents" == *"MONERO_WALLET_PASSWORD=\"walletpass\""* ]] [[ "$env_contents" == *"MONERO_WALLET_NAME=\"$wallet_dir/test_wallet\""* ]]
**Both paths:** - Generate random RPC credentials (12-char user, 24-char password). - Write `.env` (chmod 600) with all values including `MONERO_WALLET_PASSWORD`. - **Caution:** `.env` persists on disk and contains the wallet password. On multi-user systems or CI, ensure the file is not world-readable, not committed to version control, and not included in backups or log captures. - Start `monero-wallet-rpc` as a background process (PID stored in `$MONERO_LOCK_DIR/wallet-rpc.pid`). - Run `./setup.sh` and report readiness. - **Credentials are not emitted in stdout JSON.** They exist only in `.env` (chmod 600). If the user needs to see them, read from `.env` directly.
No suspicious patterns detected.