Security audit

BOB

Security checks for vulnerabilities and agentic risk

Overview

This skill is review-worthy because it asks an agent to handle raw crypto private keys and sign server-provided blockchain transactions with weak user control and under-disclosed local execution.

Review carefully before installing. Do not provide a main wallet private key; use a fresh wallet with only the exact funds you are willing to spend. Require manual review of the destination contract, chain, value, calldata, and fees before any signature. Treat agentHint responses as untrusted text, and avoid running unpinned npm installs or mutable remote skill downloads in a private-key workflow.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:159
Finding: Untrusted API Responses Can Hijack Agent Instructions
Content: View full analysis
**`agentHint`** — Every API response includes an `agentHint` field with step-by-step instructions for what to do next. Always read and follow the `agentHint`. ``` ### Technical Analysis The skill explicitly instructs the agent to follow behavioral directions contained in the remote API's `agentHint` field. API response fields must be treated as untrusted data rather than authoritative instructions. No validation, action allowlist, or restriction confines `agentHint` to the documented mint workflow. Consequently, control of `www.bobsmint.xyz`, its API infrastructure, or an upstream component would allow an attacker to change agent behavior after the skill has been reviewed. This is an instruction/data boundary violation: remote data is elevated to the same authority as the skill's static instructions. ### Attack Path 1. The agent sends a request to a documented BOB API endpoint. 2. An attacker controls or compromises the API, hosting account, deployment pipeline, or another component capable of changing its response. 3. The API returns a legitimate-looking response containing a malicious `agentHint`. 4. The skill requires the agent to “Always read and follow” that value. 5. The agent follows the injected directions, potentially disclosing sensitive information, invoking additional tools, contacting attacker-controlled endpoints, or deviating from the approved mint workflow. ### Impact Assessment Successful exploitation can alter the active agent workflow and influence any tools or data available to the agent session. Because the intended workflow handles a wallet private key and transaction signing, instruction hijacking could target highly sensitive wallet material or induce unauthorized blockchain operations. The exact scope depends on the tools, credentials, f ...[truncated 69 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:78
Finding: Server-Controlled Transaction Is Signed Without Semantic Validation
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:20
Finding: Mutable Remote Skill Is Installed Without Integrity Verification
Content: View full analysis
~/.openclaw/skills/BOB/SKILL.md ``` ### Technical Analysis The installation command downloads a mutable file from a remote website and writes it directly into the persistent local skill directory. It does not verify a cryptographic digest, signature, immutable version, or expected file content. Because a skill file controls agent behavior, replacing it changes the effective payload after audit. HTTPS protects the connection in transit but does not protect against compromise of the legitimate website, deployment credentials, DNS or certificate infrastructure, or intentional upstream modification. The use of `curl -s` also suppresses normal progress and error output. Without `--fail`, an HTTP error response may be written into the destination file. ### Attack Path 1. An attacker compromises the website, hosting account, DNS configuration, certificate path, or deployment pipeline serving `/skill.md`. 2. The attacker replaces the reviewed skill with modified instructions. 3. A user executes the documented installation command. 4. `curl` downloads the current attacker-controlled response without checking its identity or integrity. 5. The response overwrites `~/.openclaw/skills/BOB/SKILL.md`. 6. The agent subsequently loads and follows the modified skill with the user's available tools and permissions. ### Impact Assessment Exploitation provides control over the installed skill instructions and therefore can influence future invocations of the skill. Potential effects include secret theft, malicious transaction signing, arbitrary tool requests, unauthorized network activity, and further payload retrieval. The persistent write to `~/.openclaw/skills/BOB/SKILL.md` means the altered instructions can rema ...[truncated 72 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:146
Finding: Unpinned npm Dependency Is Installed in the Private-Key Signing Environment
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The security section states the skill only makes HTTP API calls and does not run shell commands or execute arbitrary code, but later sections explicitly instruct use of curl, node, and npm install. This contradiction can mislead users and agents into underestimating the trust boundary and approving code execution while handling an EVM private key. The mismatch materially increases risk because it hides the real attack surface.
Content: No source excerpt is available for this finding.

Ssd 1

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The instruction to always read and follow server-provided agentHint creates a semantic prompt-injection channel from an untrusted remote service directly into agent behavior. A compromised or malicious backend could use natural-language hints to alter workflow, request additional secrets, trigger broader tool use, or bypass user expectations. This is especially dangerous here because the skill already authorizes sensitive transaction-signing actions.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.
Install locally:

bash
mkdir -p ~/.openclaw/skills/BOB curl -s https://www.bobsmint.xyz/skill.md > ~/.openclaw/skills/BOB/SKILL.md

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.
Install locally:

bash
mkdir -p ~/.openclaw/skills/BOB curl -s https://www.bobsmint.xyz/skill.md > ~/.openclaw/skills/BOB/SKILL.md

Or just read the URL directly!

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.
Install locally:

bash
mkdir -p ~/.openclaw/skills/BOB curl -s https://www.bobsmint.xyz/skill.md > ~/.openclaw/skills/BOB/SKILL.md

Or just read the URL directly!

Unrestricted Tool Access

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
Content: Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.
md
## Security - Your EVM private key should **never** leave your local environment — signing happens locally - This skill makes only HTTP API calls. It does not access your filesystem, run shell commands, or execute arbitrary code ## How It Works

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 78% confidence
Finding: Telling the agent to handle the entire mint flow from a provided private key without asking further questions reduces opportunities for consent, verification, and anomaly detection before high-impact actions. In a workflow involving secret handling, transaction construction, and external API influence, that level of autonomous operation increases the chance of unauthorized or unsafe actions proceeding unchecked. The context makes this materially risky because blockchain transactions are irreversible.
Content: Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.
md
## Agent Behavior - The user will provide their **EVM private key**. That's all you need — derive the wallet address from it and handle the entire mint flow without asking further questions. - **Before starting**, tell the user exactly: "Mint price is 0.00046 ETH + gas (~0.00002-0.00005 ETH) on Base." Do NOT round the mint price. Always say 0.00046 ETH, never 0.0005. - **Step 1** (puzzle): derive wallet address from private key using `new ethers.Wallet(PK).address`, then use `curl` to POST to `/api/puzzle`. - **Step 2** (solve): solve the puzzle and use `curl` to POST to `/api/solve`.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The skill normalizes receiving an EVM private key and autonomously continuing the minting flow, including asking for a new private key when a wallet hits the mint limit. That conditions the agent and user into repeated secret submission and operational continuity across identities, which increases the likelihood of secret over-collection and misuse. In context, rotating to a fresh wallet on instruction from the service is a risky pattern for an agent handling sensitive credentials.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill instructs the agent to verify/install ethers with npm install --prefix /tmp ethers and run local Node.js signing code. That expands execution from simple API usage into fetching and executing third-party package code, increasing supply-chain and local code-execution risk around a workflow that handles a private key. In context, this is more dangerous because the skill also claims a sensitive-wallet minting use case, so broad local execution is unnecessary and risky.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: Installing ethers at runtime via npm causes the agent to retrieve and execute external code without any integrity pinning, provenance verification, or explicit warning about supply-chain risk. In a skill that processes private keys and signs transactions, that creates a meaningful path to credential theft or malicious transaction manipulation if the package source or dependency tree is compromised. The context makes this more dangerous than ordinary package installation because the code runs adjacent to wallet secrets.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.