Wdh

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:50 AM UTC
• Version: 0.3.1

Overview

The skill is mostly coherent for paid WDH.sh utilities, but it asks agents to run an unpinned npm CLI with a wallet private key that can authorize payments.

Review before installing. Use only a dedicated low-balance Base wallet, never a primary wallet key, avoid logging or committing the private key, prefer pinning the CLI to a reviewed version, and confirm each upload or paid command before running it. Do not upload private documents or secrets to the file or markdown publishing commands.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:60

Finding

Unpinned npm CLI Executes Remote Package Code with Access to a Funded Wallet Key

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 60–68
Vulnerability Type: Unpinned third-party dependency execution with access to sensitive credentials
Risk Level: High

Vulnerable snippet:

bash

bunx @wdhsh/cli --help        # zero-install, one-shot
npm i -g @wdhsh/cli && wdh --help

bash

export WDH_WALLET_PRIVATE_KEY=0x...

Once the env var is set, every command pays automatically. Without it the CLI refuses to run.

Technical Analysis

The documented installation and execution commands do not pin @wdhsh/cli to a reviewed version. Consequently, bunx @wdhsh/cli can retrieve and execute whatever package version the npm registry resolves at invocation time. The global installation command has the same issue and may additionally execute package installation lifecycle scripts.

This creates a time-of-check/time-of-use supply-chain boundary: auditing this skill does not establish which future version of the external CLI will execute. If the npm publisher account, package, registry resolution, or a future release is compromised, attacker-controlled JavaScript can run locally.

The impact is amplified because the CLI is explicitly run with WDH_WALLET_PRIVATE_KEY in its environment. Code executing within the package can read that environment variable directly. It may also access files and network resources allowed to the invoking user. The documentation confirms that this key controls a wallet funded with USDC on Base mainnet and that commands automatically authorize payments.

No malicious implementation of @wdhsh/cli was present in the audited project, and the audit does not establish that the current npm package is malicious. The confirmed weakness is the unsafe, unpinned trust and execution model documented by the skill.

Attack Path

1. An attacker compromises the npm package, its publisher credentials, or the package release process.
2. The attacker publishe ...[truncated 1326 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to an explicitly reviewed version in every command, for example:

   bash

   bunx @wdhsh/cli@0.3.1 --help
   

   Update the version only through a controlled review process.

2. Prefer a committed dependency lockfile and reproducible installation workflow over on-demand resolution of the latest registry release. Enforce package integrity hashes where the selected package manager supports them.

3. Disable unnecessary npm lifecycle scripts during installation, then separately verify that the CLI functions without them:

   bash

   npm install --ignore-scripts --save-exact @wdhsh/cli@0.3.1
   

4. Verify package provenance, publisher identity, signatures or attestations, and integrity before promoting a new version.

5. Avoid exposing a raw wallet private key to a dynamically downloaded process. Prefer a constrained signer, hardware-backed wallet, isolated signing service, or wallet policy that limits destination contracts, token amounts, and cumulative spending.

6. Run the CLI in a sandbox with minimal filesystem and network permissions. Supply only the credentials required for the specific operation.

7. Continue using a dedicated low-balance wallet, but also enforce strict balance and allowance limits. Immediately rotate the wallet if execution of a compromised dependency is suspected.

8. Add explicit user confirmation before paid calls, particularly the higher-cost feedback and support operations, and display the exact charge before signing.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill requires a raw EVM private key in an environment variable and states that every CLI command signs payments automatically, but it does not present a strong, prominent warning that this credential is highly sensitive and effectively grants spending authority over the wallet. In agent environments, secrets passed via environment variables may be exposed through logs, subprocesses, debugging output, or broader runtime compromise, enabling unauthorized payments or wallet drain.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly encourages uploading local files and publishing markdown to publicly accessible URLs, but it does not place a clear, prominent warning near those commands that the resulting content may be publicly exposed and accessible by anyone with the link. In an agent context, this increases the risk of accidental disclosure of sensitive local files, internal notes, credentials, or proprietary data if the tool is invoked on the wrong input.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.