T09 · Insecure Skill Coding Practices
Error
- Location
scripts/wallet.js:109- Finding
Wallet Mnemonic Exposed Through Agent-Visible Standard Output
- Content
View full analysis
- Remediation
View remediation
Security audit
Agent Wallet
Security checks for vulnerabilities and agentic risk
Overview
This wallet skill is mostly coherent with its purpose, but it handles crypto seed phrases and can send or bridge funds with too little containment for routine installation.
Install only for disposable or low-value test wallets unless the seed handling, Solana derivation, transaction confirmation, test scripts, and allowance behavior are fixed. Do not reuse an existing funded mnemonic, do not run the bundled test bridge scripts with a real seed, and review every transfer or bridge before allowing an agent to execute it.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/wallet.js:510- Finding
Raw Private Keys Delegated to Third-Party Bridge Adapters
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
test-bridge.js:18- Finding
Executable Test Script Discloses Partial Private-Key Material and Automatically Bridges Funds
- Content
View full analysis
{ try { // Single adapter for both chains (like Circle's example) const adapter = createViemAdapterFromPrivateKey({ privateKey: privateKey, }); console.log("---------------Starting Bridging---------------"); console.log("From: Base_Sepolia"); console.log("To: Ethereum_Sepolia"); console.log("Amount: 1.00 USDC"); const result = await kit.bridge({ from: { adapter, chain: "Base_Sepolia" }, to: { adapter, chain: "Ethereum_Sepolia" }, amount: "1.00", }); console.log("RESULT", inspect(result, false, null, true)); } catch (err) { console.log("ERROR", inspect(err, false, null, true)); } }; bridgeUSDC(); ``` `test-bridge-debug.js` performs the same automatic operation: ```javascript const bridgePromise = kit.bridge({ from: { adapter, chain: "Base_Sepolia" }, to: { adapter, chain: "Ethereum_Sepolia" }, amount: "1.00", }); const timeoutPromise = new Promise((_, reject) => setTimeout(() => reject(new Error("Bridge timeout after 60s")), 60000) ); const result = await Promise.race([bridgePromise, timeoutPromise]); ``` `test-bridge-events.js` also initiates the bridge automatically: ```javascript const bridgePromise = kit.bridge({ from: { adapter, chain: "Base_Sepolia" }, to: { adapter, chain: "Ethereum_Sepolia" }, amount: "1.00", }); const timeoutPromise = new ...[truncated 2176 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/bridge-async.js:255- Finding
Bridge Grants Token Allowance Beyond the Required Amount
- Content
View full analysis
= approveAmount) { console.log('✅ Already has sufficient allowance'); return setState(bridgeId, { status: STATES.APPROVED }); } // Approve generous amount const tx = await usdc.approve(fromChain.tokenMessenger, approveAmount); ``` ### Technical Analysis The bridge approves the CCTP Token Messenger to spend 200% of the requested bridge amount. The burn operation elsewhere in the implementation limits `maxFee` to 10% of the amount, so a two-times allowance exceeds the amount and configured maximum fee required for the transaction. ERC-20 allowances commonly remain active after the intended operation. If the bridge consumes less than the approved amount, the residual authorization remains available to the spender contract. This violates least privilege by granting more token authority than the declared bridge operation requires. ### Attack Path 1. A user starts an asynchronous bridge for a given USDC amount. 2. The script approves the Token Messenger for twice that amount. 3. The bridge consumes only the amount and applicable fee, leaving residual allowance. 4. The configured spender contract, its upgrade authority, or the address configuration is compromised. 5. The compromised spender invokes `transferFrom()` against the remaining allowance. 6. Additional USDC is removed from the wallet without a new user approval. ### Impact Assessment The potential loss is bounded by the unused allowance and the wallet’s available USDC balance. The finding does ...[truncated 260 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/wallet.js:73- Finding
Solana Key Derivation Does Not Implement the Documented BIP-44 Path
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (70)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
The documentation instructs users to create a local .env file for wallet secrets, which is a sensitive credential storage pattern. While common in development, using plaintext environment files for seed phrases in a wallet-management skill raises the risk of accidental disclosure through source control, backups, malware, shell history, or agent/logging exposure.
- Content
git clone https://github.com/voltagemonke/Agent-wallet.git cd Agent-wallet npm install cp .env.example .env
Edit .env with your seed phrase
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 89% confidence
- Finding
The explicit instruction to edit .env with a seed phrase normalizes storing a highly privileged wallet secret in plaintext configuration. In this skill context, compromise of that file means complete takeover of all supported chain accounts derived from the mnemonic and potential immediate theft of assets.
- Content
cd Agent-wallet npm install cp .env.example .env
Edit .env with your seed phrase
text ---
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The finding shows the skill actually performs bridge estimation/testing with hidden wallet secret access and lacks the advertised support for wallet creation, balances, transfers, and Solana. In a wallet skill, such discrepancies undermine informed consent and can mislead automated routing systems into invoking a transaction-capable component under incomplete or false assumptions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The finding shows the skill actually performs bridge estimation/testing with hidden wallet secret access and lacks the advertised support for wallet creation, balances, transfers, and Solana. In a wallet skill, such discrepancies undermine informed consent and can mislead automated routing systems into invoking a transaction-capable component under incomplete or false assumptions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The finding shows the skill actually performs bridge estimation/testing with hidden wallet secret access and lacks the advertised support for wallet creation, balances, transfers, and Solana. In a wallet skill, such discrepancies undermine informed consent and can mislead automated routing systems into invoking a transaction-capable component under incomplete or false assumptions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The finding shows the skill actually performs bridge estimation/testing with hidden wallet secret access and lacks the advertised support for wallet creation, balances, transfers, and Solana. In a wallet skill, such discrepancies undermine informed consent and can mislead automated routing systems into invoking a transaction-capable component under incomplete or false assumptions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The finding shows the skill actually performs bridge estimation/testing with hidden wallet secret access and lacks the advertised support for wallet creation, balances, transfers, and Solana. In a wallet skill, such discrepancies undermine informed consent and can mislead automated routing systems into invoking a transaction-capable component under incomplete or false assumptions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The finding shows the skill actually performs bridge estimation/testing with hidden wallet secret access and lacks the advertised support for wallet creation, balances, transfers, and Solana. In a wallet skill, such discrepancies undermine informed consent and can mislead automated routing systems into invoking a transaction-capable component under incomplete or false assumptions.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Run: `node scripts/wallet.js create`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Run: `node scripts/wallet.js create`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Run: `node scripts/wallet.js create`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Run: `node scripts/wallet.js create`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Run: `node scripts/wallet.js create`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Run: `node scripts/wallet.js create`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Run: `node scripts/wallet.js create`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Run: `node scripts/wallet.js create`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Run: `node scripts/wallet.js create`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Run: `node scripts/wallet.js create`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Run: `node scripts/wallet.js create`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Run: `node scripts/wallet.js create`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Run: `node scripts/wallet.js create`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Run: `node scripts/wallet.js create`
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Run: `node scripts/wallet.js create`
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - **One seed per agent** - Each agent instance isolated - **Seed shown once** - Only at creation, never logged - **Memory only** - Private keys derived on-demand, never persisted - **No chat import** - Seeds added via .env only (except generation) ## Error Handling
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md - **One seed per agent** - Each agent instance isolated - **Seed shown once** - Only at creation, never logged - **Memory only** - Private keys derived on-demand, never persisted - **No chat import** - Seeds added via .env only (except generation) ## Error Handling
Static analysis
Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/bridge-async.js:120
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- scripts/wallet.js:523
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- test-bridge-debug.js:11
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- test-bridge-events.js:11
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- test-bridge.js:19
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- test-estimate.js:11
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- test-estimate2.js:11