T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:225- Finding
Plaintext Collection and Storage of an API Wallet Private Key
- Content
View full analysis
- Remediation
View remediation
Security audit
Aster Futures
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent Aster trading helper, but it asks the agent to collect and save crypto API private keys in plaintext while enabling high-impact trading and withdrawal actions.
Install only after replacing the credential workflow with a secure secret manager or isolated signer. Do not paste private keys into chat, upload plaintext key files, or store keys in TOOLS.md. Use a dedicated, least-privilege API wallet, disable withdrawal and transfer permissions unless strictly needed, enable IP restrictions where available, and require explicit confirmation for each state-changing financial action.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill advertises authenticated capabilities including withdrawals, transfers, leverage changes, margin changes, and order placement, but the capability description does not foreground the financial risk of these operations. In a trading skill, exposing destructive endpoints without strong, repeated safety gates increases the chance of accidental or socially engineered loss, especially since authenticated requests can move funds or alter risk settings.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill gives users a simple three-line format to submit full credentials, including a private key, directly to the agent. Encouraging direct disclosure of raw secrets in conversational or file-upload workflows is dangerous because those channels are commonly logged, retained, inspected, or reused by other tooling, enabling credential compromise and unauthorized fund movement.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill claims secrets should never be fully displayed, but then documents a TOOLS.md structure containing full private keys. This contradiction normalizes plaintext secret handling and can cause operators or downstream agents to record or expose sensitive credentials in files that are easier to read, copy, or commit accidentally.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The instructions to add new accounts direct the agent to gather and store API private keys locally without any warning about persistence risk, access control, or safer alternatives. Because these credentials authorize trading and withdrawals, insecure storage can directly lead to account takeover and unauthorized financial actions.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill creates a direct workflow for soliciting and retaining users' API private keys in a local account file. This is dangerous because it turns the agent into a collector and custodian of highly sensitive secrets that can authorize trading and withdrawals, expanding the blast radius far beyond a single API call.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation states that requests require EIP-712 signing, but the sample code actually wraps the hash with
encode_defunctand signs it as an EIP-191/personal-sign message. In an authentication skill, this mismatch is dangerous because integrators may implement the wrong scheme, causing auth failures or, worse, signing semantics that differ from what the server verifies, which can lead to insecure client implementations and confusion around what exactly is being authorized.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly tells the agent to collect and persist users' API wallet private keys in TOOLS.md, which creates a local secret store unrelated to merely sending Aster API requests. Persisting raw private keys in a general skill/account file greatly increases the chance of credential leakage through logs, backups, source control, or later prompt/tool access.
- Content