RanchiMall Messenger

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:47 AM UTC
• Version: 1.0.21

Overview

The skill matches a FLO messenger/blockchain tool, but it needs Review because it can move funds and handle private keys while exposing secrets in arguments/output and allowing local JSON file access outside its stated storage area.

Install only if you deliberately want an agent to operate FLO messaging, signing, transfers, admin updates, and local caches. Keep FLO_PRIVATE_KEY out of chat, avoid commands that pass --privkey, --privkeys, --pin, --secret, or --shares, treat any secure-privkey output as sensitive, restrict access to local cache files, and review/fix the IDB path handling before using it with untrusted database names.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: idb_node.js:32

Finding

Path Traversal Enables JSON File Access Outside the Intended Storage Directory

Content

View full analysis

/idb_data/../../target.json ``` The same unsafe path is used by read, write, initialization, and deletion operations. The target must contain valid JSON for structured read or update operations, but the delete operation can remove any accessible file whose path can be expressed with the automatically appended `.json` suffix. ### Attack Path 1. An attacker persuades the Agent or operator to run an `idb_node.js` action with a crafted `--db` value. 2. The valu ...[truncated 1192 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: crypto_node.js:39

Finding

Private Keys, PINs, Secrets, and Recovery Shares Are Accepted Through Process Arguments

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: dapp_node.js:79

Finding

PIN and Complete Private-Key Recovery Material Are Printed Together to Standard Output

Content

View full analysis

Remediation

View remediation

other

Warning

• Location: scripts/floBlockchainAPI.js:22

Finding

Library Initialization Automatically Discloses the Caller’s Public IP to Third-Party Services

Content

View full analysis

{ return fetch('https://api.ipify.org?format=json').then(response => response.json()) .then(result => { return torExitNodes.has(result.ip) }).catch(e => { console.error(e) return false }) } let isTor = false; checkIfTor().then(result => { isTor = result if (isTor) { DEFAULT.apiURL.FLO.push('http://kvrddx6heo47rbbt77etxg6litckacbgos3nv5z7vc23ol2kjjeq72id.onion/') // DEFAULT.apiURL.FLO_TEST.push('http://omwkzk6bd6zuragdqsrhdyzgxzre7yx4vzrou4vzftintzc2dmagp6qd.onion:15017/') } }); ``` The Bitcoin library has equivalent automatic behavior: ```js const checkIfTor = btcOperator.checkIfTor = () => { return fetch('https://check.torproject.org/api/ip') .then(res => res.json()) .then(res => { return res.IsTor }).catch(e => { console.error(e) return false }) } let isTor = false; checkIfTor().then(result => isTor = result); ``` The token library also defines an IP lookup against `api.ipify.org` and uses it for Tor detection and endpoint selection. ### Technical Analysis The requests occur as a side effect of loading the libraries rather than in response to an explicit Tor-detection action. This means operations that load these components can contact `api.ipify.org` or `check.torproject.org` even when the requested blockchain operation does not otherwise require those third parties. Although every network service necessarily observes the source IP of a connection, these calls cre ...[truncated 1476 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (112)

YARA rule 'ransomware_behavior': Ransomware-like patterns (mass encryption, ransom notes) [malware]

Critical

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · btc_node.js (reported line 15)May include surrounding context.

js

node btc_node.js --action validate --address <BTC_ADDR>
 *   node btc_node.js --action multisig --pubkeys "<PUB1,PUB2,PUB3>" --required <N>
 *   node btc_node.js --action convert --address <ADDR> --from <TYPE> --to <TYPE>
 *
 * Note: This script does NOT require FLO_PRIVATE_KEY — all actions are read-only
 *       or use keys you supply via flags. No funds are moved by this script.
 *       To send BTC, use the raw signed hex via --action broadcast.
 */

'use strict';

// ── Bootstrap ──
(function bootstrap() {
    const fs = require('fs');
    const vm = require('vm');
    const path = require('path');
    global.floGlobals = { blockchain: "FLO", application: "messenger", adminID: "FMRsefPydWznGWneLqi4ABeQAJeFvtS3aQ" };
    Object.defineProperty(global, 'navigator', { value: { userAgent: "node", plugins: [], mimeTypes: [], cookieEnabled: false, language: "en" }, writable: true, configurable: true });
    Object.defineProperty(global, 'screen', { value: { height: 1080, width

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This variant correctly highlights undeclared credential/private-key storage, PIN protection, session management, and app/trusted-ID administration capabilities. In a wallet- and messaging-oriented skill, hidden or under-described key-management and administrative functions are materially more dangerous because they operate close to the user's private key and governance controls.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

This variant correctly highlights undeclared credential/private-key storage, PIN protection, session management, and app/trusted-ID administration capabilities. In a wallet- and messaging-oriented skill, hidden or under-described key-management and administrative functions are materially more dangerous because they operate close to the user's private key and governance controls.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This variant correctly highlights undeclared credential/private-key storage, PIN protection, session management, and app/trusted-ID administration capabilities. In a wallet- and messaging-oriented skill, hidden or under-described key-management and administrative functions are materially more dangerous because they operate close to the user's private key and governance controls.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

This variant correctly highlights undeclared credential/private-key storage, PIN protection, session management, and app/trusted-ID administration capabilities. In a wallet- and messaging-oriented skill, hidden or under-described key-management and administrative functions are materially more dangerous because they operate close to the user's private key and governance controls.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

This variant correctly highlights undeclared credential/private-key storage, PIN protection, session management, and app/trusted-ID administration capabilities. In a wallet- and messaging-oriented skill, hidden or under-described key-management and administrative functions are materially more dangerous because they operate close to the user's private key and governance controls.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This variant correctly highlights undeclared credential/private-key storage, PIN protection, session management, and app/trusted-ID administration capabilities. In a wallet- and messaging-oriented skill, hidden or under-described key-management and administrative functions are materially more dangerous because they operate close to the user's private key and governance controls.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This variant correctly highlights undeclared credential/private-key storage, PIN protection, session management, and app/trusted-ID administration capabilities. In a wallet- and messaging-oriented skill, hidden or under-described key-management and administrative functions are materially more dangerous because they operate close to the user's private key and governance controls.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

This variant correctly highlights undeclared credential/private-key storage, PIN protection, session management, and app/trusted-ID administration capabilities. In a wallet- and messaging-oriented skill, hidden or under-described key-management and administrative functions are materially more dangerous because they operate close to the user's private key and governance controls.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This variant correctly highlights undeclared credential/private-key storage, PIN protection, session management, and app/trusted-ID administration capabilities. In a wallet- and messaging-oriented skill, hidden or under-described key-management and administrative functions are materially more dangerous because they operate close to the user's private key and governance controls.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

This variant correctly highlights undeclared credential/private-key storage, PIN protection, session management, and app/trusted-ID administration capabilities. In a wallet- and messaging-oriented skill, hidden or under-described key-management and administrative functions are materially more dangerous because they operate close to the user's private key and governance controls.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

This variant correctly highlights undeclared credential/private-key storage, PIN protection, session management, and app/trusted-ID administration capabilities. In a wallet- and messaging-oriented skill, hidden or under-described key-management and administrative functions are materially more dangerous because they operate close to the user's private key and governance controls.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md

- All scripts strictly require the `FLO_PRIVATE_KEY` environment variable (except `contacts_node.js` and `pubkey_node.js --action my-pubkey`).

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

md

- All scripts strictly require the `FLO_PRIVATE_KEY` environment variable (except `contacts_node.js` and `pubkey_node.js --action my-pubkey`).

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

md

- All scripts strictly require the `FLO_PRIVATE_KEY` environment variable (except `contacts_node.js` and `pubkey_node.js --action my-pubkey`).

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

md

- All scripts strictly require the `FLO_PRIVATE_KEY` environment variable (except `contacts_node.js` and `pubkey_node.js --action my-pubkey`).

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

**Messaging scripts** (`send_node.js`, `receive_node.js`, `mail_node.js`, `groups_node.js`, `pubkey_node.js`, `multisig_node.js`) load via `node_shared.js`:

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

md

**Messaging scripts** (`send_node.js`, `receive_node.js`, `mail_node.js`, `groups_node.js`, `pubkey_node.js`, `multisig_node.js`) load via `node_shared.js`:

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

**Messaging scripts** (`send_node.js`, `receive_node.js`, `mail_node.js`, `groups_node.js`, `pubkey_node.js`, `multisig_node.js`) load via `node_shared.js`:

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

**Messaging scripts** (`send_node.js`, `receive_node.js`, `mail_node.js`, `groups_node.js`, `pubkey_node.js`, `multisig_node.js`) load via `node_shared.js`:

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

md

**Messaging scripts** (`send_node.js`, `receive_node.js`, `mail_node.js`, `groups_node.js`, `pubkey_node.js`, `multisig_node.js`) load via `node_shared.js`:

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

**Messaging scripts** (`send_node.js`, `receive_node.js`, `mail_node.js`, `groups_node.js`, `pubkey_node.js`, `multisig_node.js`) load via `node_shared.js`:

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

md

**Messaging scripts** (`send_node.js`, `receive_node.js`, `mail_node.js`, `groups_node.js`, `pubkey_node.js`, `multisig_node.js`) load via `node_shared.js`:

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 261)May include surrounding context.

md

**Messaging scripts** (`send_node.js`, `receive_node.js`, `mail_node.js`, `groups_node.js`, `pubkey_node.js`, `multisig_node.js`) load via `node_shared.js`:

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md

| `scripts/floCrypto.js` | FLO key derivation and signing |

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/floCrypto.js:41

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/lib.js:2945