Security audit

Autobahn

Security checks for vulnerabilities and agentic risk

Overview

This skill is in Review because it uses an unverified downloaded CLI for wallet, legal, financial, and on-chain actions, and its examples handle secrets unsafely.

Install only if you are comfortable trusting the Autobahn release binary and have independently verified its source or digest. Avoid putting real private keys, master passwords, or JWTs in shell history, environment variables, logs, or --include-secrets output. Use limited-purpose wallets, review every transaction and legal document before signing, and route court filings through qualified human counsel.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/install.sh:4
Finding: Unverified Remote Binary Download and Execution
Content: View full analysis
&2 echo "${INSTALL_DIR}/autobahn" exit 0 fi echo "Downloading autobahn ${VERSION} for ${OS}-${ARCH_SUFFIX}..." >&2 mkdir -p "$INSTALL_DIR" if command -v curl >/dev/null 2>&1; then curl -fsSL -o "${INSTALL_DIR}/autobahn" "$URL" elif command -v wget >/dev/null 2>&1; then wget -q -O "${INSTALL_DIR}/autobahn" "$URL" else echo "Neither curl nor wget found" >&2 exit 1 fi chmod +x "${INSTALL_DIR}/autobahn" echo "$VERSION" > "$VERSION_FILE" echo "Installed autobahn ${VERSION} to ${INSTALL_DIR}/autobahn" >&2 echo "${INSTALL_DIR}/autobahn" ``` The downloaded executable is then explicitly required by the Skill: ```bash AUTOBAHN_BIN=$(bash ./scripts/install.sh) ``` ### Technical Analysis The installer retrieves a native executable from an external GitHub release repository and immediately marks it executable. It does not verify a cryptographic checksum, detached signature, Sigstore identity, provenance attestation, or immutable artifact digest. HTTPS protects the transport connection but does not establish that the release asset itself is the artifact reviewed by the auditor. The effective code executed by the Skill can therefore change after the p ...[truncated 2255 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:1505
Finding: Private Keys and Master Passwords Passed Through Unsafe Command-Line and Environment Channels
Content: View full analysis
``` ```bash If you already have a private key, store it first then register with `--wallet`: autobahn config init --private-key 0x... --master-password ``` ```bash # Set master password so the CLI can unlock the private key for signing export AUTOBAHN_MASTER_PASSWORD= # Login (auto-signs using stored private key, uses agent_uuid from config) autobahn login ``` Additional configuration examples repeat the unsafe pattern: ```bash autobahn config init --api-url https://api.autobahn.surf --chain-id 8453 --rpc-url https://mainnet.base.org autobahn config init --private-key 0x... --master-password mypassword autobahn config unlock --master-password mypassword autobahn config show autobahn config show --include-secrets --master-password mypassword ``` The documented environment-variable interface includes: ```text - `AUTOBAHN_MASTER_PASSWORD` — env var for non-interactive unlock - `AUTOBAHN_API_URL` — override API endpoint - `AUTOBAHN_CHAIN_ID` — override chain - `AUTOBAHN_AUTH_TOKEN` — override auth token (JWT Bearer token for authenticated endpoints) - `AUTOBAHN_PRIVATE_KEY` — override deployer private key ``` ### Technical Analysis Secrets supplied as command-line arguments can be retained in shell history and may be exposed through process inspection, audit logging, terminal recording, orchestration logs, or diagnostic tooling. This is particularly dangerous for `--private-key`, because disclosure directly transfers control of the associated wallet. Exporting secrets through ...[truncated 2972 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Memory Manipulation

High

Category: Memory Poisoning
Confidence: 80% confidence
Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
Content: Scanner excerpt · SKILL.md (reported line 891)May include surrounding context.
md
**Rules:** - ALL legal citations must reference valid Wyoming statutes only. - Include agreement identification, loan id, and document hashes. - Include a clear statement of breach, cure period, and notice of intent to file suit. - Include exhibits list. - Self-verify citations before submission.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill hard-codes Wyoming-specific legal drafting and governance assumptions without requiring explicit user confirmation that Wyoming law applies. In a broader agent environment, this can cause the system to generate jurisdictionally incorrect legal documents or advice, creating legal and financial harm through misfiling, unenforceable agreements, or incorrect compliance steps.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 1479)May include surrounding context.
md
- **Reputation reduction:** Registered agents -2 bits, active AutoCo owners -4 bits, completed loan borrowers -6 bits - **Applies to:** The 5 PoW-protected endpoints listed above All other endpoints (including reads, auth, and most write operations) do not require PoW. ### API Versioning

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The section header and note say ERC-4337 is 'OPTIONAL — Server-Side Only' and that agents do not need to interact with it directly. Elsewhere, the skill explicitly requires the CLI to call prepare-userop, sign the UserOp hash locally from secrets.enc, and call send-userop for governance operations, which is direct agent interaction with the UserOp flow.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: This is a markdown file, so vague-trigger checks apply. The description "Operate autonomous onchain-governed entities via agents" is a very broad capability statement and does not specify concrete trigger phrases, boundaries, or exclusions, which could cause the skill to match a wide range of generic governance, contracts, or community-management requests.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The skill states 'NOT available: ... no litigation automation' for unincorporated entities. Later it says that on default the platform still 'generates default notice + evidence package' for unincorporated borrowers, which is at least a partial litigation-related automation capability and contradicts the blanket earlier statement.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.