T03 · Remote Payload Retrieval and Execution
Error
- Location
skill.md:175- Finding
Unverified Remote Installer Is Piped Directly into a Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
Celo Agent Skills
Security checks for vulnerabilities and agentic risk
Overview
This is a legitimate Celo development guide, but it needs review because it normalizes unsafe installer and wallet-key handling patterns that could expose funds if followed literally.
Review before installing. Use pinned, verified tool versions; avoid curl-to-bash and @latest scaffolding in sensitive projects; never use production or highly funded wallet keys in .env files or command-line arguments; require explicit confirmation and endpoint/recipient validation before mainnet, DeFi, bridging, or x402 payment actions.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T08 · Insecure Dependencies
Error
- Location
skills/celo-composer/SKILL.md:25- Finding
Mutable and Unpinned Third-Party Packages Are Downloaded and Executed
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
skills/evm-foundry/SKILL.md:303- Finding
Raw Wallet Private Keys Are Expanded into Process Arguments
- Content
View full analysis
"setName(string)" "New Name" \ --rpc-url https://forno.celo.org \ --private-key $PRIVATE_KEY # Transfer CELO cast send --value 1ether \ --rpc-url https://forno.celo.org \ --private-key $PRIVATE_KEY ``` Deployment and verification from `skills/contract-verification/SKILL.md`: ```bash forge create \ --rpc-url https://forno.celo.org \ --private-key $PRIVATE_KEY \ --etherscan-api-key $ETHERSCAN_API_KEY \ --verify \ src/MyContract.sol:MyContract \ --constructor-args "MyToken" 1000000 ``` Stablecoin transfer from `skills/celo-stablecoins/SKILL.md`: ```bas ...[truncated 1930 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
skills/8004/SKILL.md:225- Finding
Autonomous Payment Trust Check Is Not Bound to the Paid Service Endpoint
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (124)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
The skill instructs users to install Foundry by piping a remote script directly into bash. This is dangerous because any compromise of the remote host, TLS trust chain, DNS resolution, or the fetched installer content can lead to immediate arbitrary code execution on the user's machine.
- Content
md # Install Foundry curl -L https://foundry.paradigm.xyz | bash && foundryup
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
The
.envexample explicitly stores a raw private key, which is a credential capable of authorizing blockchain transactions. In this context, exposure of the key can lead directly to theft of funds, malicious deployments, ownership transfer, or loss of control over smart contracts, and blockchain actions are often irreversible.- Content
Environment Variables
bash # .env PRIVATE_KEY=0xYOUR_PRIVATE_KEY ETHERSCAN_API_KEY=your_celoscan_api_key
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 94% confidence
- Finding
Documenting
PRIVATE_KEY=0xYOUR_PRIVATE_KEYin a.envexample encourages direct use of plaintext private keys for signing and deployment. In Web3 workflows, compromise of that key enables irreversible asset theft, malicious deployments, admin action abuse, and impersonation of the deployer account, making the exposure materially dangerous even if shown as a placeholder.- Content
Environment Variables Template
bash # .env PRIVATE_KEY=0xYOUR_PRIVATE_KEY ETHERSCAN_API_KEY=your_celoscan_api_key
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
Using 'curl ... | bash' executes remote content immediately with no integrity verification, so a compromised upstream host, CDN, TLS interception, or malicious update could lead to arbitrary code execution on the developer machine. In a skill meant for agent-assisted execution, this pattern is especially dangerous because it normalizes blind execution of network-fetched scripts.
- Content
bash # Install Foundryup (the Foundry installer) curl -L https://foundry.paradigm.xyz | bash # Install Foundry tools foundryup
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
The shell pipeline directly chains network retrieval into code execution via '| bash', removing any review step and amplifying the impact of a malicious or tampered response into immediate arbitrary command execution. This is a classic unsafe command pattern and materially increases supply-chain risk for anyone following the guide verbatim.
- Content
bash # Install Foundryup (the Foundry installer) curl -L https://foundry.paradigm.xyz | bash # Install Foundry tools foundryup
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Load environment variables:
bash source .envWriting Contracts
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
Load environment variables:
bash source .envWriting Contracts
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
};
text ## Enable Developer Mode in MiniPay 1. Open MiniPay app on your phone 2. Navigate to **Settings**
Instruction Override
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.
- Content
};
text ## Enable Developer Mode in MiniPay 1. Open MiniPay app on your phone 2. Navigate to **Settings**
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 75% confidence
- Finding
Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.
- Content
md 2. Navigate to **Settings** 3. Scroll to **About** section 4. Tap **Version** number repeatedly (7+ times) 5. You'll see "Developer Mode enabled" message 6. Go back to **Settings** 7. New option: **Developer Settings** appears 8. Enable **Developer Mode** toggle
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill is marked user-invocable and lists broad trigger conditions such as general Celo UI work, wallet connection, smart contracts, and AI agents without clear scoping boundaries. This can cause over-activation and make the agent apply powerful blockchain-development guidance in situations where a narrower or safer skill would be more appropriate.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
The skill publicly enumerates internal/raw skill repository paths, which reveals the broader capability surface and naming of related skills. An attacker can use this information to target follow-on prompt injection, capability probing, or selective invocation of adjacent skills.
- Content
md ### Client & Frontend - [viem](https://raw.githubusercontent.com/celo-org/agent-skills/main/skills/viem/SKILL.md) - TypeScript client with fee currency support - [wagmi](https://raw.githubusercontent.com/celo-org/agent-skills/main/skills/wagmi/SKILL.md) - React hooks for Celo dApps
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
This line exposes another internal skill path, contributing to enumeration of the agent's available capabilities. Repeated disclosure increases the usefulness of the inventory for adversarial users attempting to map and manipulate agent behavior.
- Content
md - [viem](https://raw.githubusercontent.com/celo-org/agent-skills/main/skills/viem/SKILL.md) - TypeScript client with fee currency support - [wagmi](https://raw.githubusercontent.com/celo-org/agent-skills/main/skills/wagmi/SKILL.md) - React hooks for Celo dApps - [thirdweb](https://raw.githubusercontent.com/celo-org/agent-skills/main/skills/thirdweb/SKILL.md) - Full-stack Web3 development
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
The exposed thirdweb skill path leaks part of the internal skill topology. While not directly code execution, it aids reconnaissance by showing exactly which adjacent capabilities and implementation guides may exist.
- Content
md - [wagmi](https://raw.githubusercontent.com/celo-org/agent-skills/main/skills/wagmi/SKILL.md) - React hooks for Celo dApps - [thirdweb](https://raw.githubusercontent.com/celo-org/agent-skills/main/skills/thirdweb/SKILL.md) - Full-stack Web3 development - [evm-wallet-integration](https://raw.githubusercontent.com/celo-org/agent-skills/main/skills/evm-wallet-integration/SKILL.md) - Wallet connection patterns
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
Listing the evm-wallet-integration skill reveals another discrete capability area that can be used for agent reconnaissance. In aggregate, these references expose an internal map of the agent-skill ecosystem.
- Content
md - [thirdweb](https://raw.githubusercontent.com/celo-org/agent-skills/main/skills/thirdweb/SKILL.md) - Full-stack Web3 development - [evm-wallet-integration](https://raw.githubusercontent.com/celo-org/agent-skills/main/skills/evm-wallet-integration/SKILL.md) - Wallet connection patterns
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
The fee-abstraction skill link continues the pattern of internal capability enumeration. In a security context, such inventories make it easier to craft targeted prompts that steer the agent into sensitive domains.
- Content
md ### Celo Features - [fee-abstraction](https://raw.githubusercontent.com/celo-org/agent-skills/main/skills/fee-abstraction/SKILL.md) - Pay gas with stablecoins - [minipay-integration](https://raw.githubusercontent.com/celo-org/agent-skills/main/skills/minipay-integration/SKILL.md) - MiniPay Mini App development
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
This reference leaks the presence of a dedicated MiniPay integration skill, which provides additional reconnaissance value. Although low severity alone, it contributes to a broader capability-disclosure issue when combined with the other enumerated links.
- Content
md - [fee-abstraction](https://raw.githubusercontent.com/celo-org/agent-skills/main/skills/fee-abstraction/SKILL.md) - Pay gas with stablecoins - [minipay-integration](https://raw.githubusercontent.com/celo-org/agent-skills/main/skills/minipay-integration/SKILL.md) - MiniPay Mini App development - [celo-stablecoins](https://raw.githubusercontent.com/celo-org/agent-skills/main/skills/celo-stablecoins/SKILL.md) - USDT, USDC, USDm, EURm, BRLm, XOFm, KESm, PHPm, COPm, NGNm, GHSm, GBPm, ZARm, CADm, AUDm, CHFm, JPYm, BRLA, VCHF, VEUR, VGBP, USDGLO, agEURA + COPM
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
The celo-stablecoins skill path exposes another specialized area of support. Attackers can infer supported financial and token operations from this inventory and refine social-engineering or prompt-based abuse accordingly.
- Content
md - [minipay-integration](https://raw.githubusercontent.com/celo-org/agent-skills/main/skills/minipay-integration/SKILL.md) - MiniPay Mini App development - [celo-stablecoins](https://raw.githubusercontent.com/celo-org/agent-skills/main/skills/celo-stablecoins/SKILL.md) - USDT, USDC, USDm, EURm, BRLm, XOFm, KESm, PHPm, COPm, NGNm, GHSm, GBPm, ZARm, CADm, AUDm, CHFm, JPYm, BRLA, VCHF, VEUR, VGBP, USDGLO, agEURA + COPM - [celo-rpc](https://raw.githubusercontent.com/celo-org/agent-skills/main/skills/celo-rpc/SKILL.md) - Blockchain interaction via RPC
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
The celo-rpc skill URL exposes backend interaction capabilities that may be attractive to an attacker mapping available tooling. The danger is primarily informational but still relevant because it reduces uncertainty for adversarial probing.
- Content
md - [celo-stablecoins](https://raw.githubusercontent.com/celo-org/agent-skills/main/skills/celo-stablecoins/SKILL.md) - USDT, USDC, USDm, EURm, BRLm, XOFm, KESm, PHPm, COPm, NGNm, GHSm, GBPm, ZARm, CADm, AUDm, CHFm, JPYm, BRLA, VCHF, VEUR, VGBP, USDGLO, agEURA + COPM - [celo-rpc](https://raw.githubusercontent.com/celo-org/agent-skills/main/skills/celo-rpc/SKILL.md) - Blockchain interaction via RPC
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
The evm-foundry skill reference reveals an adjacent smart-contract-development capability. This helps enumerate the stack and may guide an attacker toward prompts involving compilation, deployment, or verification flows.
- Content
md ### Smart Contracts - [evm-foundry](https://raw.githubusercontent.com/celo-org/agent-skills/main/skills/evm-foundry/SKILL.md) - Foundry development (recommended) - [contract-verification](https://raw.githubusercontent.com/celo-org/agent-skills/main/skills/contract-verification/SKILL.md) - Celoscan, Blockscout, Sourcify
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
This contract-verification skill link contributes to exposure of the internal capability catalog. Even low-risk disclosures can become meaningful when aggregated across many references in one skill.
- Content
md - [evm-foundry](https://raw.githubusercontent.com/celo-org/agent-skills/main/skills/evm-foundry/SKILL.md) - Foundry development (recommended) - [contract-verification](https://raw.githubusercontent.com/celo-org/agent-skills/main/skills/contract-verification/SKILL.md) - Celoscan, Blockscout, Sourcify
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
The x402 skill path discloses support for agent-payment functionality, which may be useful to adversaries researching monetization or external-call capabilities. This is primarily a reconnaissance concern rather than direct exploitation.
- Content
md - [8004](https://raw.githubusercontent.com/celo-org/agent-skills/main/skills/8004/SKILL.md) - ERC-8004 Agent Trust Protocol - [x402](https://raw.githubusercontent.com/celo-org/agent-skills/main/skills/x402/SKILL.md) - HTTP-native agent payments
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
The celo-defi link exposes DeFi integration capabilities that may attract targeted misuse attempts. Its main risk is enabling capability discovery and narrowing the attacker's search space.
- Content
md ### DeFi & Bridging - [celo-defi](https://raw.githubusercontent.com/celo-org/agent-skills/main/skills/celo-defi/SKILL.md) - DeFi protocol integration - [bridging](https://raw.githubusercontent.com/celo-org/agent-skills/main/skills/bridging/SKILL.md) - Asset bridging to/from Celo
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
The bridging skill path signals asset-movement functionality, which can be sensitive in financial contexts. Revealing this capability contributes to a detailed map of what the agent may help users do.
- Content
md - [celo-defi](https://raw.githubusercontent.com/celo-org/agent-skills/main/skills/celo-defi/SKILL.md) - DeFi protocol integration - [bridging](https://raw.githubusercontent.com/celo-org/agent-skills/main/skills/bridging/SKILL.md) - Asset bridging to/from Celo
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 80% confidence
- Finding
The celo-composer skill reference leaks scaffolding and project-template support within the skill ecosystem. Though individually minor, it adds to a complete internal inventory useful for adversarial planning.
- Content
md ### Scaffolding - [celo-composer](https://raw.githubusercontent.com/celo-org/agent-skills/main/skills/celo-composer/SKILL.md) - Project templates and scaffolding
Static analysis
Detected: suspicious.generated_source_template_injection
User-controlled placeholder is embedded directly into generated source code.
Critical
- Code
- suspicious.generated_source_template_injection
- Location
- skills/contract-verification/references/verification-config.md:79
User-controlled placeholder is embedded directly into generated source code.
Critical
- Code
- suspicious.generated_source_template_injection
- Location
- skills/evm-foundry/SKILL.md:94