AgentConstitution

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:51 AM UTC
• Version: 1.0.0

Overview

This is a coherent Base Sepolia governance helper, but it asks agents to obey mutable on-chain governance state and includes unsafe signing guidance that users should review carefully.

Install only if you intend to let this skill consult the listed Base Sepolia governance contracts, and treat all returned rules/status as untrusted data for user review rather than automatic instructions. Use a dedicated testnet-only wallet, avoid passing raw private keys on the command line, and do not put secrets, personal data, prompts, or sensitive operational details into public action-log descriptions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:12

Finding

Externally Controlled Governance Rules Can Influence Agent Behavior

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:105

Finding

Private Key Is Passed Through a Command-Line Argument

Content

View full analysis

"description" \ --rpc-url https://sepolia.base.org \ --private-key $AGENT_PRIVATE_KEY ``` ### Technical Analysis The documented command expands `AGENT_PRIVATE_KEY` into the argument vector of the `cast` process. Secrets supplied through command-line arguments may become visible through process inspection, diagnostic collection, shell tracing, execution telemetry, crash reports, or wrappers that record invoked commands. Although environment variables also require protection, expanding the variable into `--private-key` increases exposure because the resulting secret becomes part of the child process's command line. Quoting the variable would prevent word splitting but would not solve command-line credential exposure. The documentation identifies the target as Base Sepolia testnet, which limits direct production-chain impact. However, compromise can still allow impersonation of the registered testnet agent, unauthorized action-log submissions, consumption of testnet funds, and reputational or testing-integrity damage. Impact could be greater if the same key were improperly reused elsewhere. ### Attack Path 1. The user stores a signing key in `AGENT_PRIVATE_KEY`. 2. The user or agent invokes the documented `cast send` command. 3. The shell expands the variable, placing the private key in the `cast` process arguments. 4. A local user, process monitor, debug logger, shell-tracing mechanism, or command wrapper records or observes the arguments. 5. The observer recovers the private key. 6. The observer signs transactions as the agent, including unauthorized ...[truncated 644 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: check-compliance.txt:5

Finding

Unvalidated and Unquoted Agent Identifier Permits Cast Argument Injection

Content

View full analysis

}" REGISTRY="0xcCFc2B8274ffb579A9403D85ee3128974688C04B" RPC="https://sepolia.base.org" echo "Checking compliance for agent #$AGENT_ID..." RESULT=$(cast call $REGISTRY "isCompliant(uint256)(bool)" $AGENT_ID --rpc-url $RPC 2>&1) ``` ### Technical Analysis `AGENT_ID` originates from the first command-line argument and is expected to be a Solidity `uint256`, but the script performs no numeric validation. Its expansion in the `cast` command is also unquoted. An unquoted shell expansion is subject to word splitting and pathname expansion. A crafted identifier containing whitespace or wildcard characters can therefore produce multiple arguments or expand to local filenames. Tokens interpreted as options by `cast` may modify the command's behavior, depending on the CLI parser and option ordering. The use of `$(...)` around the command does not cause shell metacharacters stored inside `AGENT_ID` to be reparsed as shell syntax, so direct arbitrary shell-command execution is not established by this code alone. The confirmed risk is manipulation of the `cast` argument vector and unreliable or misleading compliance checks. ### Attack Path 1. An attacker supplies a crafted value where the script expects an agent ID. 2. The value contains whitespace, wildcard characters, or additional `cast` option-like tokens. 3. The unquoted `$AGENT_ID` expansion is split or expanded by the shell. 4. `cast` receives arguments different from the intended single unsigned integer. 5. The query fails, targets altered command options where supported, or produces output that does not represent the requested agent. 6. A calling workflow that relies on the resulting status may make an incorrect trust or complia ...[truncated 494 chars]

Remediation

View remediation

}" if [[ ! "$AGENT_ID" =~ ^[0-9]+$ ]]; then printf '%s\n' "Error: agentId must be an unsigned decimal integer." >&2 exit 64 fi ``` 2. Quote all variable expansions: ```bash RESULT=$(cast call "$REGISTRY" \ "isCompliant(uint256)(bool)" \ "$AGENT_ID" \ --rpc-url "$RPC" 2>&1) ``` 3. Use a Bash array when constructing commands dynamically. 4. Apply a reasonable length or numeric-bound check consistent with `uint256`. 5. Keep fail-closed behavior for malformed input and RPC errors, and ensure callers distinguish an error from a noncompliant result. 6. Add tests covering whitespace, wildcard characters, leading option syntax, empty input, oversized integers, and malformed numeric values. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: get-rules.txt:8

Finding

Unvalidated and Unquoted Rule Identifier Permits Cast Argument Injection

Content

View full analysis

&1 ``` ### Technical Analysis The script accepts a rule identifier from the command line without confirming that it is an unsigned decimal integer. The unquoted expansions of `$RULE_ID`, `$CONSTITUTION`, and `$RPC` are passed directly to `cast`. The fixed contract and RPC values currently contain no shell separators, but quoting them remains necessary defensive practice. The attacker-controlled `$RULE_ID` is the primary risk: shell word splitting and pathname expansion can transform one supplied value into multiple `cast` arguments. Depending on `cast` argument parsing, option-like tokens can alter invocation behavior or force errors. No `eval`, nested shell execution, or equivalent reparsing operation is present. Consequently, the reviewed code does not establish direct arbitrary shell-command execution. The demonstrated issue is argument injection into the external CLI and loss of query integrity. ### Attack Path 1. An attacker supplies a crafted rule ID containing whitespace, wildcard characters, or option-like content. 2. The script copies the value into `RULE_ID` without validation. 3. The shell expands unquoted `$RULE_ID` into one or more command arguments. 4. `cast` processes an altered argument vector rather than a single `uint256`. 5. The rule query fails, executes with modified CLI options where supported, or returns data unrelated to the intended query. 6. A user or automated agent may rely on incomplete, incorrect, or attacker-influenced governance output. ### Impact Assessment The primary impact is loss of integrity and availability for rule retrieval. An a ...[truncated 353 chars]

Remediation

View remediation

&2 exit 64 fi ``` 2. Quote all expansions in the command: ```bash cast call "$CONSTITUTION" \ "getRule(uint256)" \ "$RULE_ID" \ --rpc-url "$RPC" 2>&1 ``` 3. Check the command's exit status and do not present error output as valid governance data. 4. Decode the expected return type explicitly and validate the returned structure before presenting it to an agent. 5. Add test cases for whitespace, globs, option-like input, oversized integers, empty values, and malformed identifiers. 6. Consider using a command array to preserve strict argument boundaries if the invocation becomes more complex. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 135)May include surrounding context.

md

echo "  2. Obey Governance (50% slash)"
  echo "  3. Transparency (20% slash)"
  echo "  4. Preserve Override (90% slash)"
  echo "  5. No Self-Modify (90% slash)"
fi

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · get-rules.txt (reported line 26)May include surrounding context.

text

echo "  2. Obey Governance (50% slash)"
  echo "  3. Transparency (20% slash)"
  echo "  4. Preserve Override (90% slash)"
  echo "  5. No Self-Modify (90% slash)"
fi

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to submit an on-chain transaction with --private-key $AGENT_PRIVATE_KEY but provides no safety guidance about secret handling, transaction signing risks, or the irreversible effects of broadcasting a transaction. In an agent-skill context, this is dangerous because users or downstream agents may operationalize the example directly, exposing credentials in insecure environments or authorizing unintended transactions without review.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.