T09 · Insecure Skill Coding Practices
Error
- Location
scripts/htlc.js:85- Finding
Trade Workflow Releases the Payment Secret Without Enforcing Asset Delivery
- Content
View full analysis
- Remediation
View remediation
Security audit
Hash Time Locked Contract
Security checks for vulnerabilities and agentic risk
Overview
This skill is a real on-chain trading helper, but it can move ETH with a raw private key while overstating atomic safety and omitting important safeguards.
Install only if you are prepared to audit the contract and workflow yourself. Use a dedicated low-value wallet, verify the chain and contract bytecode independently, test on a testnet first, and do not rely on the advertised atomic/trustless claims for real NFT or inscription purchases.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/htlc.js:16- Finding
ETH Is Sent to a Hard-Coded Contract Without Deployment or Bytecode Verification
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/htlc.js:90- Finding
Documented Timeout and Automatic Refund Guarantees Are Not Implemented by the CLI
- Content
View full analysis
'); console.log(' node htlc.js reveal '); console.log(' node htlc.js trade '); console.log(' node htlc.js status '); } } ``` The README states: ```md ## How Agents Trade 1. Seller generates secret 2. Buyer locks ETH → Seller reveals secret → Funds transfer atomically 3. If seller doesn't respond in 24h → ETH returns to buyer ``` ### Technical Analysis The ...[truncated 1726 chars]- Remediation
View remediation
` CLI command that verifies eligibility, simulates the call, submits the transaction, and reports confirmation. 4. Add `confirmReceipt ` only if it is genuinely required by the reviewed protocol. 5. If automatic recovery is intended, implement a reliable transaction-submission mechanism and clearly document its availability, authorization model, fees, and failure modes. 6. Otherwise, replace the automatic-return claim with accurate instructions explaining that the buyer must submit a refund transaction after expiry. 7. Display the absolute expiration timestamp, chain time, and recovery instructions immediately after locking. 8. Add tests for expiration boundaries, unauthorized refunds, already completed locks, failed RPC calls, and transaction replacement. 9. Do not represent the workflow as atomic until the payment and asset transfer are enforced as one settlement operation. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The trade workflow explicitly prints the preimage as 'keep secret' and then immediately instructs the user to share that same preimage with the seller. In an HTLC flow, disclosure of the preimage defeats the secrecy property and can let the counterparty or observers use it to claim or redirect value depending on the contract design and trade sequencing, making the workflow unsafe by design.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README promotes autonomous on-chain trading and ETH locking in HTLC contracts but does not warn users that funds may be irreversibly transferred, locked until timeout, or exposed to loss if counterparties, parameters, or contract addresses are wrong. In an AI-agent context, the omission is more dangerous because it encourages unattended asset movement without explicit human approval, risk limits, or verification steps.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs users to export a raw PRIVATE_KEY in their shell environment but provides no warning about key custody, shell history, process leakage, or the risk of draining funds if the key is exposed. In a blockchain trading skill, this omission is materially dangerous because the credential directly controls on-chain assets and is likely to be used on a live wallet.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The documented commands perform ETH locking and release operations for HTLC trading, but the skill does not warn that blockchain transactions are irreversible, can execute against the wrong address or hash, and may permanently lock or transfer funds if parameters are incorrect. Because this skill is specifically designed for atomic swaps and escrow on live EVM chains, the lack of transaction-risk guidance makes operator error and fund loss significantly more likely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The reveal command broadcasts the preimage on-chain and triggers release of funds without an explicit warning or confirmation. Because reveal is a final state-changing operation in an HTLC, accidental execution, wrong lockHash/preimage pairing, or rushed operator use can cause irreversible asset release.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trade command automatically performs an on-chain ETH lock as part of a 'full trade workflow' without any confirmation prompt, dry-run summary, or explicit warning that funds will be irreversibly committed. This increases the chance of operator error, misuse, or social-engineering-induced loss, especially because the script is a CLI that may be run with copied parameters.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 91% confidence
- Finding
The dependency version for ethers is specified with a caret range (^6.0.0), which allows installation of newer minor and patch releases that have not been explicitly reviewed. While this is common practice and not inherently malicious, it creates supply-chain risk because a compromised or breaking upstream release could be pulled in automatically.
- Content
json "keywords": ["htlc", "trade", "inscription", "nft", "evm", "base", "atomic-swap"], "license": "MIT", "dependencies": { "ethers": "^6.0.0" }, "peerDependencies": {}, "engines": {
Static analysis
No suspicious patterns detected.