T03 · Remote Payload Retrieval and Execution
Error
- Location
DEPENDENCIES.md:17- Finding
Mutable Remote Installation Script Executed with Root Privileges
- Content
View full analysis
- Remediation
View remediation
Security audit
ens-manager
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to perform its stated ENS management purpose, but it asks agents to handle wallet secrets and execute irreversible mainnet transactions with under-scoped safeguards.
Review before installing. Use a dedicated low-value wallet, avoid command-line passwords or raw private keys, run read-only dry runs first, verify every mainnet transaction manually, and do not run the documented curl-to-sudo installer without independent verification. This is not malicious from the inspected artifacts, but it is high-risk for wallet operations as written.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/create-subdomain.js:43- Finding
Wallet Passwords and Private Keys Exposed Through Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/register-ens-name.js:77- Finding
Custom Keystore Uses Unauthenticated AES-CBC Encryption
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
scripts/package.json:1- Finding
Wallet-Handling Dependencies Are Mutable and Not Locked Reproducibly
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (32)
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
Piping
curloutput directly intosudois a high-risk command-chaining pattern because it executes remote content as root without inspection. In the context of a developer skill, users may copy-paste this blindly, making the documentation itself a vehicle for unsafe privileged execution.- Content
md **Install if needed:** - macOS: `brew install node` - Ubuntu: `curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash - && sudo apt-get install -y nodejs` - Windows: Download from https://nodejs.org ---
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 97% confidence
- Finding
Piping
curloutput directly intosudois a high-risk command-chaining pattern because it executes remote content as root without inspection. In the context of a developer skill, users may copy-paste this blindly, making the documentation itself a vehicle for unsafe privileged execution.- Content
md **Install if needed:** - macOS: `brew install node` - Ubuntu: `curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash - && sudo apt-get install -y nodejs` - Windows: Download from https://nodejs.org ---
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md **Not published:** - node_modules/ (gitignored) - .env files (gitignored) - Local testing files ---
Self-Modification
High
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
- Content
clawdhub install YOUR-USERNAME/ens-manager
text **Update skill README:** Add install instructions at top: ```markdown
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The guide recommends supplying wallet passwords and even raw private keys directly on the command line, which can leak through shell history, process listings, CI logs, telemetry, or agent traces. In an autonomous-agent setting this is especially dangerous because secrets may be persisted or echoed by tooling outside the author's control, enabling wallet compromise and theft of all accessible assets.
- Content
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md # ENS Manager > Complete ENS workflow - register names, create subdomains, publish IPFS content in minutes ## The Problem Managing ENS names requires multiple tools: app.ens.domains for registration, manual contract calls for subdomains, IPFS pinning services for content, and separate gateways for publishing. Each step takes time and technical knowledge. ## This Skill Automates the complete ENS workflow from registration to published website - one command per operation, proper three-phase registration, automatic wrapped/unwrapped handling. --- ## 📋 Requirements - Node.js 18+ - viem ^1.20.0 - content-hash ^2.5.2 - Ethereum wallet keystore - ETH for gas + registration fees --- ## ⚡ What It Does ### Register New .eth Names - **Check availa
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
Broad capability claims combined with instructions to use local wallet/keystore material and send on-chain transactions create a trust and expectation gap. Even if some features are missing, the dangerous part is that the skill normalizes providing sensitive credentials and signing blockchain actions without a tightly scoped, accurate declaration of what will happen.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Broad capability claims combined with instructions to use local wallet/keystore material and send on-chain transactions create a trust and expectation gap. Even if some features are missing, the dangerous part is that the skill normalizes providing sensitive credentials and signing blockchain actions without a tightly scoped, accurate declaration of what will happen.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Broad capability claims combined with instructions to use local wallet/keystore material and send on-chain transactions create a trust and expectation gap. Even if some features are missing, the dangerous part is that the skill normalizes providing sensitive credentials and signing blockchain actions without a tightly scoped, accurate declaration of what will happen.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
Broad capability claims combined with instructions to use local wallet/keystore material and send on-chain transactions create a trust and expectation gap. Even if some features are missing, the dangerous part is that the skill normalizes providing sensitive credentials and signing blockchain actions without a tightly scoped, accurate declaration of what will happen.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/create-subdomain-ipfs.js yourname.eth subdomain QmIPFS123... \
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/create-subdomain-ipfs.js yourname.eth subdomain QmIPFS123... \
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/create-subdomain-ipfs.js yourname.eth subdomain QmIPFS123... \
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script decrypts a keystore to obtain a private key, but then creates a wallet client without binding that key as the signing account. As a result, transactions may be sent from whatever account the runtime/provider exposes, causing users to believe they are using the keystore account while actually spending funds from a different wallet or failing unpredictably.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
The specific use of
sudo -Epreserves environment variables while executing as root, increasing risk because untrusted or unintended environment state can influence privileged execution. Combined with a fetched script, this creates a particularly unsafe installation pattern in documentation.- Content
md **Install if needed:** - macOS: `brew install node` - Ubuntu: `curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash - && sudo apt-get install -y nodejs` - Windows: Download from https://nodejs.org ---
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 90% confidence
- Finding
The specific use of
sudo -Epreserves environment variables while executing as root, increasing risk because untrusted or unintended environment state can influence privileged execution. Combined with a fetched script, this creates a particularly unsafe installation pattern in documentation.- Content
md **Install if needed:** - macOS: `brew install node` - Ubuntu: `curl -fsSL https://deb.nodesource.com/setup_20.x | sudo -E bash - && sudo apt-get install -y nodejs` - Windows: Download from https://nodejs.org ---
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation tells users to run
sudo chown -R $USER ~/.npmto fix permissions, which performs a recursive ownership change with elevated privileges but does not explain the system-impact risks or safer alternatives. Recursive privileged ownership changes can unintentionally alter security-sensitive files, normalize unsafe troubleshooting practices, and mask an underlying permissions misconfiguration.- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 92% confidence
- Finding
This command requires
sudoto recursively change ownership of the npm directory. While intended as troubleshooting, it can damage local security boundaries or fix the wrong problem if a user runs it blindly, especially because it modifies filesystem ownership under elevated privileges.- Content
bash # Fix npm permissions sudo chown -R $USER ~/.npm npm install
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instructions direct the user to run
gh repo create --public --source=. --pushand laterclawdhub publish .without an explicit warning that these commands upload the current local repository contents to public remote services. In a skill workspace, users may incorrectly assume only selected files are published, increasing the risk of unintentionally exposing sensitive code, configs, notes, or other repository contents.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The troubleshooting section includes
gh repo delete ens-manager --yesas a ready-to-run command without clearly warning that deletion is destructive and may permanently remove the remote repository and its contents. Users following troubleshooting steps under time pressure could delete the wrong repository or lose work unnecessarily.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The GitHub publishing instructions explicitly use
gh repo create ens-manager --publicwithout warning the user that all repository contents will become publicly accessible. In a skill that may contain operational scripts, wallet-related workflows, environment hints, or internal documentation, this increases the risk of accidental disclosure if users follow the commands verbatim.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The quick-start opens with 'For autonomous agent operations' and 'Copy-paste ready commands' while immediately presenting live ENS registration and subdomain creation workflows that incur real cost and produce irreversible on-chain effects. In an agent skill context, that framing materially increases the chance an agent or operator will execute mainnet transactions without explicit confirmation, budget checks, or rollback awareness.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The debugging section says testing on Sepolia is not supported and advises using small subdomains on mainnet for testing, normalizing experimentation with real funds and real ENS state. That guidance is risky because users or agents may treat testing as harmless and trigger unintended paid transactions or irreversible changes during validation and debugging.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md --- ### Create Subdomain with Website **Time: 1-2 minutes**
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill describes handling wallet keystores, passwords, and on-chain transactions but does not declare any explicit tool scope or permission boundaries. That omission makes the sensitive capability opaque to users and host systems, increasing the risk of unintended access to environment-backed secrets or unsafe execution with wallet material.
- Content