T08 · Insecure Dependencies
Warning
- Location
SKILL.md:248- Finding
Unpinned Third-Party Dependencies in Security-Sensitive Workflows
- Content
View full analysis
- Remediation
View remediation
Security audit
Submit to AgentBeat
Security checks for vulnerabilities and agentic risk
Overview
This skill is purpose-aligned but needs Review because it handles wallet private keys and payment signing in ways that could expose funds.
Install only if you are comfortable with a wallet/payment workflow. Prefer an external signer, hardware wallet, OS keychain, or encrypted vault; do not store raw private keys in credentials.json, avoid transcript/log exposure of generated keys, use a low-balance wallet, pin and audit dependencies, and add explicit per-payment limits and allowlists before enabling automatic x402 payments.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
reference/wallet-setup.md:10- Finding
Private-Key Disclosure Through Standard Output and Optional Plaintext Persistence
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
reference/x402-integration.md:61- Finding
Automatic x402 Payment Signing Without Enforced Spending Controls
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (33)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
The skill explicitly defines a local credentials file path for handling sensitive wallet material, including a private key, and normalizes plaintext secret storage as an operational option. Even with owner confirmation and chmod 600, plaintext private keys on disk are highly sensitive and can be stolen by other local processes, malware, backups, or accidental disclosure.
- Content
md - name: EVM_PRIVATE_KEY required: false description: Agent wallet private key. Prefer loading from an external signer or credential store. Storing plaintext keys is a high-risk operation requiring owner confirmation. Required only when signing transactions. credentials_path: ~/.config/agentbeat/credentials.json --- # Submit to AgentBeat
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 89% confidence
- Finding
Requiring security decisions to be recorded in the same credentials.json file increases the sensitivity and centrality of that file, which may already hold wallet secrets. Consolidating operational approvals and credential-related metadata in one local artifact enlarges the blast radius if the file is accessed or copied.
- Content
md Before Step 1 / Step 3 / Step 5: 1. Must ask owner explicitly. 2. Must record decision in `~/.config/agentbeat/credentials.json` (or execution note if file unavailable). 3. Must stop if required decision is missing, ambiguous, or denied. ### `KEY_HANDLING_GATE` (before Step 1)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The skill asks the owner to explicitly approve local plaintext storage of a private key in ~/.config/agentbeat/credentials.json. User approval does not materially reduce the risk of secret compromise; storing raw blockchain private keys in plaintext enables full wallet takeover if the host or file is exposed.
- Content
text Please confirm private key handling: 1) external signer / secure credential store (preferred), or 2) local plaintext storage in ~/.config/agentbeat/credentials.json (high risk). Reply with one explicit approval.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
Backing up credentials.json can duplicate any stored private keys or signatures into additional files, increasing the number of sensitive artifacts on disk. More copies create more opportunities for theft through local compromise, syncing software, or accidental sharing.
- Content
bash TIMESTAMP=$(date +%Y%m%d_%H%M%S) cp ~/.config/agentbeat/credentials.json ~/.config/agentbeat/credentials.backup.${TIMESTAMP}.json chmod 600 ~/.config/agentbeat/credentials.backup.${TIMESTAMP}.json
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
Creating a predictable local credentials.json file as the central store for wallet and submission state is risky when the skill may place private keys there. Predictable secret locations are easier for malware and opportunistic local attackers to target.
- Content
bash mkdir -p ~/.config/agentbeat touch ~/.config/agentbeat/credentials.json chmod 600 ~/.config/agentbeat/credentials.json
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The file-permission step protects the credentials file but does not mitigate the core issue that sensitive wallet material may be stored in plaintext on disk. A compromised user account, malicious process running as the same user, or insecure backup tooling can still read the file.
- Content
bash mkdir -p ~/.config/agentbeat touch ~/.config/agentbeat/credentials.json chmod 600 ~/.config/agentbeat/credentials.jsonBlock:
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 86% confidence
- Finding
The quick reference reinforces the credentials.json location as a standard operational target, which encourages broad dependence on a local file likely to accumulate sensitive data. Publicly documenting a predictable secret location can make automated harvesting easier on compromised systems.
- Content
text Flow: Wallet -> Gas -> ERC-8004 -> x402 -> Submit/Claim Gates: KEY_HANDLING_GATE, ENDPOINT_DECLARATION_GATE, REWARD_ADDRESS_GATE, AGENT_LEGITIMACY_GATE, OWNERSHIP_PROOF_GATE Credentials: ~/.config/agentbeat/credentials.json
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 85% confidence
- Finding
The skill requires recording owner decisions in credentials.json or an equivalent execution log, which risks mixing operational credentials with consent records and other metadata in a commonly reused file. This can expand the blast radius of any local file disclosure and may normalize writing potentially sensitive owner-supplied data into broadly accessible logs without clear access controls.
- Content
md Before `POST /api/v1/submissions`, the following are hard requirements: 1. **Must ask** owner for required decisions. 2. **Must record** decisions (in `credentials.json` or equivalent execution log). 3. **Must stop** if decisions are missing. ### `REWARD_ADDRESS_GATE` (required)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 88% confidence
- Finding
Instructing the agent to write the submission voucher into ~/.config/agentbeat/credentials.json creates a sensitive local secret-handling issue because the voucher is required for reward claiming and may be usable by anyone who obtains it. Storing it in a generic credentials file without access-control guidance or encryption makes theft through local compromise, backups, logs, or workspace sharing more likely.
- Content
}
text **Save the `voucher` immediately.** It cannot be retrieved later and is required to claim rewards. Write it to `~/.config/agentbeat/credentials.json`. > **Voucher usage beyond claiming (requires owner consent):** The voucher may also serve as proof of submission in campaign activities — for example, replying to official campaign tweets or posting in the MoltBook comment section. However, sharing the voucher or wallet address publicly is an **irreversible, sensitive operation**. You **must** ask your owner for explicit confirmation before posting it anywhere. Present the exact text you plan to post and the destination URL, and wait for approval. Never share it autonomously.
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Persisting Credentials
After generating, save the address (and non-secret metadata only) to
~/.config/agentbeat/credentials.json:bash mkdir -p ~/.config/agentbeat
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Persisting Credentials
After generating, save the address (and non-secret metadata only) to
~/.config/agentbeat/credentials.json:bash mkdir -p ~/.config/agentbeat
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Persisting Credentials
After generating, save the address (and non-secret metadata only) to
~/.config/agentbeat/credentials.json:bash mkdir -p ~/.config/agentbeat
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Persisting Credentials
After generating, save the address (and non-secret metadata only) to
~/.config/agentbeat/credentials.json:bash mkdir -p ~/.config/agentbeat
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Persisting Credentials
After generating, save the address (and non-secret metadata only) to
~/.config/agentbeat/credentials.json:bash mkdir -p ~/.config/agentbeat
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 77% confidence
- Finding
This prompt explicitly offers 'local plaintext approved' storage for a private key in ~/.config/agentbeat/credentials.json. Even with owner approval, normalizing plaintext private key persistence in a predictable path creates a serious theft risk from malware, backups, logs, accidental disclosure, or multi-process access on the host.
- Content
text Please confirm private key handling: 1) "external signer approved" (preferred), or 2) "local plaintext approved" for ~/.config/agentbeat/credentials.json (high risk). If neither is approved, I will stop.
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The skill instructs persistent wallet setup and allows long-term storage of the private key, creating durable secret material on the endpoint. Persistent private keys substantially increase exposure over time and can lead to irreversible asset loss or identity hijacking if the host is compromised.
- Content
chmod 600 ~/.config/agentbeat/credentials.backup.${TIMESTAMP}.json
text ## Step 1: Create or Locate EVM Wallet Action:
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 86% confidence
- Finding
Persisting the voucher under ~/.config/agentbeat/credentials.json creates durable session-like state for a claim artifact that should be tightly controlled. Because the voucher cannot be reissued and is required to claim rewards, unnecessary persistence increases exposure to later compromise from other local processes, backups, repository sync, or multi-user environments.
- Content
}
text **Save the `voucher` immediately.** It cannot be retrieved later and is required to claim rewards. Write it to `~/.config/agentbeat/credentials.json`. > **Voucher usage beyond claiming (requires owner consent):** The voucher may also serve as proof of submission in campaign activities — for example, replying to official campaign tweets or posting in the MoltBook comment section. However, sharing the voucher or wallet address publicly is an **irreversible, sensitive operation**. You **must** ask your owner for explicit confirmation before posting it anywhere. Present the exact text you plan to post and the destination URL, and wait for approval. Never share it autonomously.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Voucher usage beyond claiming (requires owner consent): The voucher may also serve as proof of submission in campaign activities — for example, replying to official campaign tweets or posting in the MoltBook comment section. However, sharing the voucher or wallet address publicly is an irreversible, sensitive operation. You must ask your owner for explicit confirmation before posting it anywhere. Present the exact text you plan to post and the destination URL, and wait for approval. Never share it autonomously.
cURL Example
bash curl -X POST https://api.agentbeat.fun/api/v1/submissions \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
cURL Example
bash curl -X POST https://api.agentbeat.fun/api/v1/submissions \ -H "Content-Type: application/json" \ -d '{ "name": "MyDeFiAgent",
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md |-------------|-------------|------------------| | `web` | Public website or dashboard | `https://youragent.example.com/` | | `A2A` | Google A2A agent-to-agent protocol | `https://youragent.example.com/.well-known/agent-card.json` | | `API` | REST or GraphQL API | `https://api.youragent.example.com/v1` | | `MCP` | Model Context Protocol server | `https://youragent.example.com/mcp` | **If your agent has no independent endpoint** (e.g. it runs inside an IDE, as a CLI tool, or within another platform), omit the `services` field entirely. Use this minimal registration file instead:
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This section provides executable examples that invoke
register()on a live mainnet RPC using a private key, which will submit irreversible on-chain transactions and consume funds. Although gas costs are listed later, the examples do not clearly warn before execution that these commands broadcast to production networks and spend real assets, which is risky in an agent skill context where instructions may be followed automatically.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
After generating, save the address (and non-secret metadata only) to
~/.config/agentbeat/credentials.json:bash mkdir -p ~/.config/agentbeat cat > ~/.config/agentbeat/credentials.json << EOF { "address": "$ADDRESS",
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
"network": "base" } EOF chmod 600 ~/.config/agentbeat/credentials.json
text > **Do not write the private key to this file by default.** Storing a plaintext private key on disk is a high-risk operation. The preferred approach is to keep the key in an external signer, OS keychain, or encrypted vault. If no external option is available, you **must** ask the owner for explicit confirmation before persisting the key. See the "Private key handling" section in SKILL.md for the full decision flow.
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
"network": "base" } EOF chmod 600 ~/.config/agentbeat/credentials.json
text > **Do not write the private key to this file by default.** Storing a plaintext private key on disk is a high-risk operation. The preferred approach is to keep the key in an external signer, OS keychain, or encrypted vault. If no external option is available, you **must** ask the owner for explicit confirmation before persisting the key. See the "Private key handling" section in SKILL.md for the full decision flow.
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
"network": "base" } EOF chmod 600 ~/.config/agentbeat/credentials.json
text > **Do not write the private key to this file by default.** Storing a plaintext private key on disk is a high-risk operation. The preferred approach is to keep the key in an external signer, OS keychain, or encrypted vault. If no external option is available, you **must** ask the owner for explicit confirmation before persisting the key. See the "Private key handling" section in SKILL.md for the full decision flow.
Static analysis
No suspicious patterns detected.