ClawHub
Back to skill

Security audit

VIGIL Security Scanner

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a DeFi scanner, but it also packages write-capable revocation and scam-report scripts while describing the main skill as read-only.

Install only if you intend to trust this package with VIGIL remote lookups and will avoid or separately review the bundled write scripts. Treat revocation and scam-report submission as state-changing actions requiring explicit user approval, and do not run scripts/run.sh with an untrusted .env file present.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:29
Finding

Overbroad Access to Agent Memory Logs

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/vigil-revoke.sh:24
Finding

Packaged On-Chain Write Actions Contradict the Declared Read-Only Boundary

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/vigil-batch-revoke.sh:34
Finding

Untrusted API Response Fields Are Inserted into Bankr Financial Commands

Content
View full analysis
Remediation
View remediation
"` with a structured, typed transaction API. - Bind the transaction to the ERC-20 `approve(spender, 0)` method and verify the destination contract and calldata before signing. - Require per-transaction confirmation or a cryptographically precise batch preview. - Restrict `VIGIL_ENDPOINT` overrides to explicitly trusted HTTPS hosts, or remove the override for financial workflows. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
scripts/run.sh:7
Finding

Project Environment File Is Executed as Arbitrary Shell Code

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (35)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared description emphasizes a keyless read-only scanner and says revoke actions are gated separately via Bankr auth. The supplied code chunk is not merely a scanner: its explicit purpose is to batch revoke risky approvals after scanning, and it directly calls the Bankr CLI to execute onchain approval revocations. That is a materially undeclared write capability within this code chunk. Additionally, the code does not implement honeypot detection, rugpull analysis, or contract safety scoring; its actual behavior is narrowly focused on scanning approvals and revoking them. Therefore the code’s behavior does not accurately match the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared description emphasizes security analysis features: token approval scanning, honeypot detection, rugpull indicator analysis, and contract safety scoring. The supplied code chunk does not implement those behaviors. Instead, it calls vigil_token_market and reports market metrics such as price, liquidity, volume, pool age, and liquidity risk, with optional notes. While a liquidity risk field could be tangentially relevant to security, the script’s primary purpose is market-data retrieval, which is materially different from the declared scanner functionality. There is also no evidence in this chunk of approval scanning, revoke gating, contract analysis, or honeypot detection.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description emphasizes keyless read-only security scanning and says write/revoke actions are separately gated. The supplied code does not scan contracts, approvals, or score safety; instead, its primary function is to report a token as a scam to the VIGIL community database. That is a materially different, undeclared write capability and contradicts the stated read-only behavior.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/run.sh (reported line 10)May include surrounding context.

sh
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
PROJECT_DIR="$(dirname "$SCRIPT_DIR")"

# Load .env if exists
if [ -f "$PROJECT_DIR/.env" ]; then
  set -a
  source "$PROJECT_DIR/.env"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/run.sh (reported line 11)May include surrounding context.

sh
PROJECT_DIR="$(dirname "$SCRIPT_DIR")"

# Load .env if exists
if [ -f "$PROJECT_DIR/.env" ]; then
  set -a
  source "$PROJECT_DIR/.env"
  set +a

Credential Access

High
Category
Privilege Escalation
Confidence
83% confidence
Finding

The script sources .env as shell code under set -a, which means any shell commands embedded in that file will execute with the privileges of the user running the script, not just variable assignments. If an attacker can modify the repository, working directory, or deployment artifact, this becomes arbitrary command execution and can expose secrets loaded into the environment.

Content

Scanner excerpt · scripts/run.sh (reported line 13)May include surrounding context.

sh
# Load .env if exists
if [ -f "$PROJECT_DIR/.env" ]; then
  set -a
  source "$PROJECT_DIR/.env"
  set +a
fi

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/smoke_test.sh (reported line 17)May include surrounding context.

sh
local body
    body=$(printf '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"%s","arguments":%s}}' "$name" "$args")
    local resp
    resp=$(curl -sS -m 45 -X POST "$ENDPOINT" -H "Content-Type: application/json" -d "$body")
    echo "$resp" | python3 -c "import sys,json
try:
    d = json.load(sys.stdin)

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

This script performs a write-side action that submits scam reports, which conflicts with the stated skill description of keyless read-only scanning and separately gated write actions. That mismatch is dangerous because users or orchestrators may grant or invoke the skill under the assumption it cannot modify external state, enabling unauthorized reputation manipulation or abuse of backend reporting capabilities.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill executes shell commands and makes outbound network requests but does not declare an explicit tool scope such as allowed-tools or permissions. That omission weakens least-privilege controls and can let a host agent grant broader execution capability than users or reviewers expect.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest/documentation presents the current skill as providing twelve read-only tools, explicitly listing Scam Check and Sentinel Status among them. However, the implementation steps only show network calls for approvals, token scan, honeypot, safety score, wallet report, wallet monitor, token market, deployer check, batch scan, and consensus; there are no corresponding calls for the two advertised tools, so the described behavior does not match the documented code.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The instruction to read the last 2 days of memory/logs introduces access to prior user or system context that may contain unrelated sensitive data. Even though the stated purpose is differential scanning, this expands data exposure beyond the immediate target and can leak historical wallet addresses, prior scans, or other user activity to the current run.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This step sends the user-supplied wallet address to an external service. While the input validation blocks injection well, the transfer still exposes potentially sensitive wallet activity and associations to a third party, which is a real data-sharing risk in a security-analysis context.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

2. Scan approvals (wallet)

bash
RESULT=$(curl -m 30 -s "https://mcp.vigil.codes/tools/call" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This call transmits the target contract address to an external API for token safety analysis. Contract addresses are public onchain, but linking them to a user's scan request still reveals user interest or trading intent to a third party.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

3. Scan token safety

bash
RESULT=$(curl -m 30 -s "https://mcp.vigil.codes/tools/call" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The honeypot check posts the target token address to an external service. In isolation this is low sensitivity, but in aggregate with the other calls it builds a detailed profile of what wallets or tokens the user is investigating.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

4. Check honeypot

bash
RESULT=$(curl -m 30 -s "https://mcp.vigil.codes/tools/call" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The safety-score request sends the scanned address off-box to a remote API. The context is a security scanner, so users may expect analysis to be privacy-conscious; repeated undisclosed transmissions make this more sensitive than an ordinary market-data request.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

5. Get safety score

bash
RESULT=$(curl -m 30 -s "https://mcp.vigil.codes/tools/call" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The wallet report call sends a wallet address to a third-party endpoint to generate a broader posture assessment. Because wallet reports can infer holdings, approvals, and behavior patterns, this is more privacy-sensitive than simple token metadata lookup.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

6. Generate wallet report

bash
RESULT=$(curl -m 30 -s "https://mcp.vigil.codes/tools/call" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The monitoring request sends a wallet address plus monitoring parameters to an external service for suspicious-activity analysis. Monitoring is especially sensitive because it can reveal ongoing user surveillance interests and potentially create persistent observation by a third party.

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

7. Monitor wallet (real-time alerts)

bash
RESULT=$(curl -m 30 -s "https://mcp.vigil.codes/tools/call" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

This call sends a token address for market-context enrichment to an external API. The data is mostly public and less sensitive than wallet scanning, but it still constitutes outbound transmission that should be declared and scoped.

Content

Scanner excerpt · SKILL.md (reported line 162)May include surrounding context.

8. Token market context (price + liquidity)

bash
RESULT=$(curl -m 30 -s "https://mcp.vigil.codes/tools/call" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

The deployer reputation request transmits the contract address to a remote service. This is mainly a privacy/transparency issue rather than an exploit primitive, since the value is public onchain and the input is strongly validated.

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

9. Deployer reputation (verification + age)

bash
RESULT=$(curl -m 30 -s "https://mcp.vigil.codes/tools/call" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The batch scan endpoint transmits the provided token list externally. In the current example only one validated address is sent, so injection risk is low, but the operation still expands third-party visibility into user-selected assets.

Content

Scanner excerpt · SKILL.md (reported line 196)May include surrounding context.

10. Batch scan multiple tokens

bash
RESULT=$(curl -m 30 -s "https://mcp.vigil.codes/tools/call" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The consensus call forwards the token address for multi-source scoring through the remote service. Because it may fan out into several underlying data sources, it can amplify disclosure beyond a single vendor, increasing privacy and supply-chain risk.

Content

Scanner excerpt · SKILL.md (reported line 213)May include surrounding context.

11. Multi-source consensus verdict

bash
RESULT=$(curl -m 30 -s "https://mcp.vigil.codes/tools/call" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 12)May include surrounding context.

Example (keyless):

bash
curl -X POST https://mcp.vigil.codes/tools/call \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call",
       "params":{"name":"vigil_safety_score",

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation states that only vigil-revoke is a gated write action, yet the same file later documents POST /report/submit, which is also a write operation. This inconsistency can mislead downstream agents, reviewers, or users into underestimating the available side effects and trusting the skill with broader permissions than intended.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-reference.md (reported line 33)May include surrounding context.

md
## Legacy REST shape (not live)

Base URL: `https://api.bankr.bot/vigil`

Authentication: `Authorization: Bearer <BANKR_API_KEY>` (for write operations)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The reference documents revocation submission and scam-report submission endpoints without an explicit warning that these actions can submit transactions or publish community reports. In an agent setting, missing warnings increase the chance of silent state-changing behavior, unintended onchain actions, or unwanted disclosure of user-supplied allegations/evidence to external systems.

Content

No source excerpt is available for this finding.