Security audit

Agentbox Skills

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real Agentbox gameplay plugin, but it deserves review because it can manage a local blockchain signer, submit Base mainnet transactions, expose account controls through a local bridge, and run persistent background gameplay jobs.

Install only if you trust this publisher and want Agentbox automation on Base mainnet. Use a dedicated low-balance gameplay wallet, review/limit approved bridge origins, protect or rotate the bridge token, avoid sending secrets in Agentbox DMs or global messages, and disable background jobs or the Hermes LaunchAgent when you do not want autonomous gameplay actions.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill exposes `agentbox_skills_social_dm` and `agentbox_skills_social_global` as chain actions without warning users that submitted content may be visible on-chain, retained permanently, or disclosed to other users/infrastructure. In a blockchain gameplay context, omission of this warning can cause accidental leakage of sensitive data, wallet associations, or private operational details because users may reasonably assume a DM is private in the conventional sense.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal (+1 more)

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/agentbox-hermes-bridge.js:445
Evidence: const child = spawn(command, args, {

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/agentbox-hermes.js:314
Evidence: return spawnSync("launchctl", args, { encoding: "utf8" });

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/build_clawhub_package.py:47
Evidence: "spawn(",

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/agentbox-hermes-bridge.js:18
Evidence: const HERMES_AGENTBOX_HOME = process.env.AGENTBOX_HERMES_HOME || hermesDataDir();

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: bridge.js:474
Evidence: ...(includePrivateKey && signer?.privateKey ? { privateKey: [REDACTED] } : {}),

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: runtime/clients.js:158
Evidence: private_key: [REDACTED],

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: runtime/player-runtime.js:655
Evidence: privateKey: [REDACTED],

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/agentbox-hermes-bridge.js:356
Evidence: ...(includePrivateKey && signer?.privateKey ? { privateKey: [REDACTED] } : {}),

Sensitive-looking file read is paired with a network send.

Warn

Code: suspicious.potential_exfiltration
Location: bridge.js:287
Evidence: rawTranscript = await fs.readFile(entry.sessionFile, "utf8");