Security audit

Agentic Money

Security checks for vulnerabilities and agentic risk

Overview

This skill is for Ethereum payments, but its examples ask agents to run unpinned JavaScript tools with wallet private keys and can submit transactions without a hard approval gate.

Review this carefully before installing. Use only a dedicated low-balance wallet, prefer testnet first, pin and install dependencies locally with a lockfile instead of using npx, and require the agent to show the exact network, recipient, amount, task ID, and gas estimate before any signing action.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:43
Finding: Unpinned Third-Party Packages Execute with Access to Wallet Credentials
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:192
Finding: Transaction Example Does Not Programmatically Enforce Explicit User Approval
Content: View full analysis
MAX_DEPOSIT) throw new Error('Exceeds 0.01 ETH safety cap'); const provider = new ethers.JsonRpcProvider('https://ethereum-sepolia.publicnode.com'); const wallet = new ethers.Wallet(process.env.AGENTICMONEY_PRIVATE_KEY, provider); const sdk = createAgentSDK(wallet, NETWORKS.sepolia); const escrow = new ECFEscrow(wallet, { escrowAddress: NETWORKS.sepolia.escrow }); const agents = await sdk.discover('code-review'); const agent = agents[0]; const taskId = ECFEscrow.generateTaskId(); console.log('About to deposit', ethers.formatEther(amount), 'ETH to', agent.address); // Agent should confirm with user here before proceeding await escrow.deposit({ taskId, serviceAgent: agent.address, amount, clientAttestationUID: process.env.MY_ATTESTATION_UID, serviceAttestationUID: agent.attestationUid, }); console.log('Hired! Task ID:', taskId); " ``` ### Technical Analysis The Skill states that the Agent must confirm transactions with the user, but the executable example does not enforce that requirement. The comment instructing the Agent to confirm is immediately followed by `escrow.deposit()`. Printing transaction details is not an authorization control, and the script has no approval input, confirmation token, process boundary, or conditional check that prevents submission. The recipient is also selected as `agents[0]` from externally obtained discovery results without validating the address, attestation, quoted price, expected identity, or correspondence with the user's selected agent. Although the a ...[truncated 1789 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (11)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 85% confidence
Finding: The skill repeatedly instructs users to run inline scripts via npx tsx without pinning an exact version of the executable or isolating execution to a preinstalled dependency. npx may resolve and execute code from the network, so a compromised or unexpected package version could run arbitrary code in a context that handles wallet private keys and can initiate blockchain transactions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 85% confidence
Finding: This usage of npx tsx is a supply-chain execution risk because it may fetch and run whatever version is currently resolved rather than a reviewed, fixed version. In this skill, the executed script loads AGENTICMONEY_PRIVATE_KEY, increasing the blast radius from generic code execution to wallet compromise or unauthorized transaction signing.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 85% confidence
Finding: Running inline blockchain interaction code through unpinned npx tsx creates a real risk of executing malicious or altered dependency code. Because this skill is specifically designed for Ethereum wallet operations, any compromise could expose private keys, alter recipient addresses, or trigger unintended on-chain actions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 85% confidence
Finding: The npx tsx invocation here is another instance of unpinned remote tool execution. Even though the example is for discovery rather than payment, the script still initializes a wallet from an environment variable, so malicious dependency resolution could leak credentials or manipulate outputs used in later payment decisions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 86% confidence
Finding: This npx tsx example performs agent registration, which can result in signed on-chain transactions. If npx resolves a compromised package or unexpected version, the attacker gains an opportunity to execute arbitrary code in a wallet-enabled process and potentially redirect funds or exfiltrate the private key.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: This is the most sensitive example because it leads directly to escrow deposit logic and transaction signing while using unpinned npx tsx. In context, a dependency hijack could not only execute arbitrary code but also interfere with recipient selection, task parameters, or the signing flow, causing direct loss of funds.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 84% confidence
Finding: Although this command is for checking task status, it still uses unpinned npx tsx and constructs a wallet from an environment variable. That means a package-resolution compromise can still execute arbitrary code and access secrets, even in what appears to be a read-only workflow.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: This npx tsx invocation initiates a claim flow in escrow and uses wallet credentials in-process. Because it is both unpinned and transaction-capable, exploitation could result in arbitrary code execution, key theft, or malicious modification of claim parameters that affect payment recovery.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The dispute flow example again combines unpinned npx execution with blockchain signing operations and wallet-secret access. In this context, a supply-chain compromise could manipulate the dispute bond, task ID, or withdrawal flow, potentially causing direct fund loss or denial of access to funds.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 84% confidence
Finding: Even this wallet-balance example uses unpinned npx tsx while loading the private key into the process. That unnecessarily exposes credentials to a network-resolved executable, turning a simple read operation into a supply-chain risk with potential secret exfiltration.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 83% confidence
Finding: The troubleshooting guidance continues recommending npx tsx without addressing version pinning or package integrity. Because the skill revolves around wallet-enabled code execution, normalizing this pattern increases the likelihood that users run unreviewed code fetched at execution time.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.