ClawHub
Back to skill

Security audit

Blankspace Agent Registration

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to do what it says, but it asks users to handle powerful wallet and Farcaster credentials in ways that need careful review before installation.

Review this skill before installing. Use a minimally funded wallet, do not store the custody mnemonic and signer private key together in plaintext, prefer a keychain or encrypted secret manager, verify signer permissions and revocation steps, confirm the Optimism contract address before signing, and avoid running the mutable `@latest` installer unless you trust the publisher and registry path.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:57
Finding

Plaintext Storage of Custody Mnemonic and Signer Private Key

Content
View full analysis
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Error
Location
README.md:6
Finding

Mutable Remote Installer Is Executed Without Version or Integrity Pinning

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:185
Finding

API-Controlled Contract Address Is Used in a Custody-Wallet Transaction Without Validation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
Findings (9)

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The documented credentials.json contains highly sensitive authentication material, including a 24-word custody mnemonic and signer private key. Any process, plugin, backup system, or attacker with filesystem access could read the file and take over the Farcaster identity, authorize actions, or pivot into related wallet-controlled operations.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

Credentials to Store

Create a credentials file (e.g., ~/.config/blankspace/credentials.json) and save each value as you go:

json
{

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The README instructs users to execute npx molthub@latest install blankspace-registration, which pulls and runs remote code at install time from the latest published package version. Using a floating latest tag creates a supply-chain risk: a compromised publisher account or malicious new release could cause arbitrary code execution on the user's machine when they follow the documentation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README normalizes third-party signer authorization and an onchain payment step without clearly warning that granting signer access can enable posting or account actions on behalf of the Farcaster identity, and that the flow may involve blockchain transactions with real funds. In this skill context, the omission is more dangerous because the stated purpose is to onboard an agent account and delegate capability to Blankspace, so users may authorize access without understanding scope, persistence, or revocation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
87% confidence
Finding

The skill explicitly tells the user to persist long-lived credentials in a local config path, increasing the attack window beyond the registration session. Persisting wallet mnemonics and signer keys creates durable exposure to malware, multi-user hosts, accidental sync to cloud storage, or inclusion in support bundles and backups.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

Credentials to Store

Create a credentials file (e.g., ~/.config/blankspace/credentials.json) and save each value as you go:

json
{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill instructs users to store a Farcaster custody mnemonic and ED25519 signer private key together in a local JSON file, which is effectively plaintext secret storage. Although it briefly says to keep them secret, it does not provide concrete safeguards such as file permissions, encryption, OS keychain usage, or secret-manager guidance, so compromise of the workspace or backups would expose full account control.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency uses a caret range, which allows npm to install newer minor and patch releases than the one originally tested. This increases supply-chain risk because a compromised or breaking upstream release could be pulled in automatically during future installs.

Content

Scanner excerpt · package.json (reported line 7)May include surrounding context.

json
"description": "Register your AI agent on Farcaster via Blankspace — get an FID, authorize a signer, set your profile, and join the decentralized social network.",
  "main": "index.js",
  "dependencies": {
    "viem": "^2.0.0",
    "@noble/curves": "^1.0.0",
    "@farcaster/hub-nodejs": "^0.12.0",
    "bip39": "^3.1.0"

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency uses a caret range instead of an exact version, so builds are not fully reproducible and may resolve to different upstream code over time. For a cryptographic library, unexpected upstream changes can be especially risky if a malicious or flawed release is introduced.

Content

Scanner excerpt · package.json (reported line 8)May include surrounding context.

json
"main": "index.js",
  "dependencies": {
    "viem": "^2.0.0",
    "@noble/curves": "^1.0.0",
    "@farcaster/hub-nodejs": "^0.12.0",
    "bip39": "^3.1.0"
  },

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

Using a version range for this dependency permits automatic adoption of future compatible releases, which can introduce supply-chain exposure or unreviewed behavioral changes. Because this skill interacts with Farcaster registration flows, dependency integrity matters even if the package file itself contains no direct exploit logic.

Content

Scanner excerpt · package.json (reported line 9)May include surrounding context.

json
"dependencies": {
    "viem": "^2.0.0",
    "@noble/curves": "^1.0.0",
    "@farcaster/hub-nodejs": "^0.12.0",
    "bip39": "^3.1.0"
  },
  "keywords": ["ai", "agent", "farcaster", "blankspace", "social", "decentralized", "registration"]

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
96% confidence
Finding

The bip39 package is referenced with a caret range, allowing later releases to be installed without explicit review. Since this package is commonly involved in mnemonic or seed handling, a compromised update could materially affect secret generation or recovery workflows.

Content

Scanner excerpt · package.json (reported line 10)May include surrounding context.

json
"viem": "^2.0.0",
    "@noble/curves": "^1.0.0",
    "@farcaster/hub-nodejs": "^0.12.0",
    "bip39": "^3.1.0"
  },
  "keywords": ["ai", "agent", "farcaster", "blankspace", "social", "decentralized", "registration"]
}

Static analysis

No suspicious patterns detected.