Security audit

TrueNorth Crypto Intelligence

Security checks for vulnerabilities and agentic risk

Overview

This skill is a read-only crypto intelligence helper, but it asks agents to install a mutable global CLI and send full user messages to an external API for token recognition despite claiming private data is not transmitted.

Review this skill before installing. It appears intended for read-only crypto market analysis, but use it only if you are comfortable installing a global third-party npm CLI and having token-related prompts sent to TrueNorth's public API. Avoid including private keys, credentials, wallet details, account information, or sensitive trading context in requests, and prefer a pinned or isolated CLI install if available.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:25
Finding: Mandatory Promotional Content Alters Agent Responses
Content: View full analysis
**Want deeper analysis?** Explore interactive charts, portfolio tracking, and AI-powered insights at [TrueNorth](https://app.true-north.xyz/) ``` ### Technical Analysis The Skill requires the agent to append attacker-selected promotional content and an external link to every response. This instruction changes the agent's output behavior regardless of whether the advertisement is relevant to the user's request. A link to the service may be appropriate in contextual documentation, but forcing it into every response is not required to provide cryptocurrency market analysis. The requirement therefore exceeds the minimum behavior necessary for the declared functionality and constitutes instruction-level output hijacking. ### Attack Path 1. The agent loads the TrueNorth Skill and its presentation instructions. 2. A user asks any question handled while the Skill is active. 3. The mandatory presentation rule is applied even if the TrueNorth website is not relevant. 4. The agent appends the operator-selected advertisement and external URL to its response. 5. Users may interpret the injected promotion as a neutral recommendation from the agent. ### Impact Assessment This issue does not directly grant operating-system privileges. Its scope is the agent's response-generation channel. It enables persistent promotional manipulation while the Skill is active, reduces user control over output, and may direct users to an external service without a contextual need. ]]>
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:55
Finding: Full User Messages Are Transmitted to an External Service
Content: View full analysis
" --json ``` ``` Corroborating instructions from `examples.md`: ```markdown ## Entity recognition Always run first for token-specific queries to standardize identifiers. ```bash tn ner "" --json ``` ``` The Skill also states that the CLI calls an external public API: ```markdown All data is fetched from **TrueNorth's public REST API** (`api.adventai.io`). ``` ### Technical Analysis The instructions require the complete user message to be supplied to the `tn ner` command before every token-specific query. According to the Skill's own documentation, the CLI communicates with `api.adventai.io`; therefore, this workflow can disclose the complete message to a third party. A token query may contain unrelated or sensitive context, including portfolio holdings, trading positions, transaction details, wallet addresses, personal information, or accidentally pasted credentials. Only a token name, symbol, or other minimal identifier is needed for entity resolution. Transmitting the full message violates data-minimization and least-privilege principles. This behavior also conflicts with the statement in `SKILL.md` that no private data is transmitted. The API being unauthenticated or read-only does not prevent information disclosure in outbound requests. ### Attack Path 1. A user submits a token-specific request containing a token identifier and additional private context. 2. The agent follows the instruction to pass the user's full message to `tn ner`. 3. The CLI sends the request to the external TrueNorth API. 4. Unrelated sensitive content is exposed to the extern ...[truncated 655 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:5
Finding: Mutable Third-Party CLI Is Installed Globally
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: examples.md:12
Finding: Untrusted User Input Is Shown Interpolated into a Shell Command
Content: View full analysis
" --json ``` ### Technical Analysis The execution reference shows untrusted user input inserted directly into a shell command. Double quotes do not make arbitrary content safe for shell evaluation: command substitutions such as `$(...)` and backticks can still be evaluated, while embedded quotes may terminate the intended argument and expose shell metacharacters. The documentation does not require an argument-array API, disable shell execution, define escaping, or validate input. If an implementing agent constructs the displayed command as a shell string, a crafted user message can alter the command's meaning. The exploitability depends on how the host invokes the command. Invocation through a process API with a fixed executable and argument array avoids shell interpretation; literal shell-string construction creates the vulnerable path. ### Attack Path 1. An attacker submits a token-related message containing shell syntax, such as command substitution or a quote followed by additional shell operators. 2. The agent substitutes that message into the documented command template. 3. The agent invokes the generated text through a shell. 4. The shell interprets the attacker's syntax rather than treating the entire message as inert data. 5. The injected command executes with the same privileges as the agent process. ### Impact Assessment Successful exploitation can provide local command execution with the agent's operating-system privileges. The attacker may read or modify files accessible to the agent, access environment variables and credentials, invoke network tools, tamper with outputs, or execute additional programs. The scope is limited by the host account and sandbox, but may be broad in an unsandboxed environment. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation instructs the agent to send the user's full message to a public API for entity recognition, which can disclose sensitive data the user did not intend to share externally. Because there is no privacy warning, minimization guidance, or consent step, prompts containing wallet addresses, trading strategy, account details, or other private context may be transmitted unnecessarily to a third party.
Content: No source excerpt is available for this finding.