T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:349- Finding
Troubleshooting Guidance May Expose Reusable Authentication Credentials
- Content
View full analysis
- Remediation
View remediation
Security audit
spherico-agent
Security checks for vulnerabilities and agentic risk
Overview
This is a markdown-only API workflow skill, but it handles wallet funds and reusable credentials with under-scoped safety guidance.
Review this skill before installing if you plan to use it with real funds or production credentials. Use only a verified Bitnow gateway, redact all tokens/API keys/signatures before sharing outputs, verify the exact blockchain network and contract addresses independently before approving or depositing funds, and avoid supplier/provider workflows unless you are authorized to manage upstream provider credentials.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:20- Finding
Contradictory Blockchain Network Configuration Can Misroute Financial Operations
- Content
View full analysis
` with the actual gateway URL as needed. ``` ```markdown ## 2. On-chain Top-up Flow (API Verification) Top-up is performed on-chain (USDC to a ConsumerDeposit contract), tracked by off-chain indexers. The API lets you verify the result. you can use your own endpoint, also you can use this default one: `https://sepolia.base.org` - User transfers USDC to the ConsumerDeposit contract with proper calldata. - Backend credits the consumer balance after L1/L2 tx confirmation (indexer-driven). - USDC address is: 0x10065E7b353371DD2e12348e7094cC774638EbEB - ConsumerDeposit contract address is: 0xB0E9ebf19AB710d3353c7F637DC55329d9727dCc - before depoist, you need to approve the allwance - deposit abi is `function deposit(uint256 amount)` ``` ### Technical Analysis The skill identifies the supported network as Base Sepolia but assigns chain ID `8453`. It also recommends the Base Sepolia RPC endpoint `https://sepolia.base.org`. These settings are inconsistent: chain ID `8453` identifies Base mainnet, whereas Base Sepolia uses a different chain ID. The same workflow provides fixed USDC and deposit-contract addresses and instructs users to approve an allowance before calling `deposit(uint256 amount)`. It does not require verification that: - The connected network's runtime chain ID matches the intended environment. - The supplied token and deposit addresses are deployed on that network. - The contracts' bytecode and identities match verified deployments. - The token decimals and requested approval amount are correct. - The transaction simulation transfers funds to the expected accounting system. Blockchain addresses are interpreted within the currently connected chain. A chain mismatc ...[truncated 1895 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md Assumptions: - A **gateway HTTP API** exists (e.g. `https://gateway-test.bitnow.ai`) - All workflows are CLI-, Curl or script-oriented, no UI assistance - Support chain is base sepolia, chain id is 8453 Replace all `<BASE_URL>` with the actual gateway URL as needed.
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill metadata and description frame the capability as consumer-facing Bitnow workflows, but the documented supplier/provider endpoints expand scope into privileged upstream registration and configuration. This can cause an agent or operator to invoke higher-risk administrative actions unexpectedly, increasing the chance of unauthorized changes, secret submission, or misuse of provider-management APIs.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The supplier API examples include raw sensitive values such as upstream API keys and bearer tokens directly in request bodies, with no warning to avoid logging, storing, or echoing them. In agent-driven or CLI contexts, these secrets can be exposed through shell history, transcripts, debug logs, telemetry, or prompt context, leading to credential theft and compromise of upstream provider accounts or GPU nodes.
- Content