📦
Audit History
AgentLink Skill - 2 audits
Version comparison
Capability and finding changes across audited versions, newest first.
Audit version 2 Latest
Jul 19, 2026, 10:11 AM
The Markdown backtick and reconnaissance alerts are false positives. Genuine risks include raw wallet-key handling, unpinned npm execution, signed third-party requests, and an endpoint advertising coordinated X activity.
1
Files scanned
181
Lines analyzed
22
Review items
0
False positives ignored
Confirmed security concerns (7)
High
Crypto seed/private key mention
Run the CLI with `npx` (no global install needed) and store your agent private key. No on-chain writ
The workflow asks users to store an agent private key through an npm CLI. Package or host compromise could disclose a wallet signing credential.
High
Crypto seed/private key mention
# Store the agent private key in the encrypted local keystore.
The CLI receives a private key before placing it in an encrypted keystore. Security depends on the package and local host remaining trustworthy.
High
Crypto seed/private key mention
**Option A — raw private key.** Simplest for a self-hosted agent that keeps its key in an environmen
The guide explicitly offers a raw private-key integration. Exposure would allow unauthorized request signatures and potentially wallet operations.
High
Crypto seed/private key mention
privateKey: process.env.AGENT_PRIVATE_KEY as `0x${string}`,
The example passes a raw wallet private key into SDK code. This is a genuine high-impact secret-handling operation.
High
Crypto seed/private key mention
privateKey: process.env.AGENT_PRIVATE_KEY as `0x${string}`,
The header builder receives the raw wallet private key. Dependency compromise or accidental logging could expose it.
High
Unpinned Package Handles Wallet Private Key
The guide runs unpinned npm packages and supplies an agent private key to them. A compromised release could steal the key.
The documented npx and npm commands omit versions, and the same workflow gives the installed software a wallet private key.
Medium
Coordinated Social Platform Activity
The advertised WURK endpoint can commission an X raid. This can enable coordinated platform manipulation without consent controls.
The skill explicitly describes the endpoint as commissioning an X raid, and no safeguards or consent requirements are stated.
Capability review items (12)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Generic API/secret keys · 2 occurrences
privateKey: process.env.AGENT_PRIVATE_KEY as `0x${string}`,
A raw wallet private key is passed from the environment into a third-party SDK. Compromise could enable unauthorized signatures and wallet actions.
Low
Hardcoded URL
const response = await agentFetch('https://api.xona-agent.com/base-main/image/nano-banana', {
The example sends a signed HTTPS POST to an external XONA service. This exposes authentication metadata and request content to that operator.
Low
Hardcoded URL
agentlink request https://api.xona-agent.com/base-main/image/nano-banana --network base
The CLI command sends a signed agentlink header to the external XONA domain. Users must trust that service with authentication metadata.
Low
Hardcoded URL
| `POST https://api.xona-agent.com/base-main/video/short-generation` | Generate a short video from a
The skill advertises an external XONA video endpoint that receives signed requests and user prompts. That creates a third-party trust boundary.
Low
Hardcoded URL
| `POST https://api.xona-agent.com/base-main/image/nano-banana` | Generate an image from a text prom
The external XONA image endpoint receives signed authentication and prompt data. Its operation depends on an unaudited third party.
Low
Hardcoded URL
| `GET https://wurkapi.fun/base/agentlink/xraid/xverified/small` | Commission an X (Twitter) raid |
The skill advertises a WURK endpoint for commissioning X activity. Use sends authentication to an external operator.
Low
Hardcoded URL
| `GET https://wurkapi.fun/base/agentlink/agenttohuman` | Commission an agent-to-human job |
The agent-to-human job endpoint is operated by an external WURK domain. Signed use creates an explicit third-party trust boundary.
Low
Environment variable access (dot notation) · 2 occurrences
privateKey: process.env.AGENT_PRIVATE_KEY as `0x${string}`,
The example reads AGENT_PRIVATE_KEY from the process environment. This is intentional credential access with meaningful exposure if dependencies or logs are compromised.
Low
Environment variable object · 2 occurrences
privateKey: process.env.AGENT_PRIVATE_KEY as `0x${string}`,
The code directly accesses the process environment to obtain a signing key. The operation is legitimate but security-sensitive.
Risk Factors
⚙️ External commands (38)
SKILL.md:19 SKILL.md:20 SKILL.md:26 SKILL.md:28-35 SKILL.md:35-37 SKILL.md:37 SKILL.md:54-56 SKILL.md:56-58 SKILL.md:58-64 SKILL.md:64-66 SKILL.md:66-68 SKILL.md:68 SKILL.md:70 SKILL.md:78 SKILL.md:80-82 SKILL.md:82-84 SKILL.md:84 SKILL.md:88-93 SKILL.md:93-95 SKILL.md:95-97 SKILL.md:97-99 SKILL.md:99-105 SKILL.md:105-109 SKILL.md:109-116 SKILL.md:116-118 SKILL.md:118-120 SKILL.md:120-126 SKILL.md:126-136 SKILL.md:136-142 SKILL.md:142-144 SKILL.md:144-146 SKILL.md:146 SKILL.md:158-159 SKILL.md:159-161 SKILL.md:161 SKILL.md:169-170 SKILL.md:170-180 SKILL.md:180
🌐 Network access (13)
🔑 Env variables (6)
Audited by: codex
Jul 9, 2026, 11:57 PM
Manual review found a prompt-only SKILL.md file with no prompt injection, embedded scripts, or hidden executable payloads. The only static finding was caused by invalid frontmatter, so it is treated as a scanner coverage false positive after review.
0
Files scanned
0
Lines analyzed
1
Review items
0
False positives ignored
Confirmed security concerns (1)
Low
Unscanned file (invalid_frontmatter) — manual review required
[unscanned: invalid_frontmatter]
Force-confirmed metadata/low static finding; AI false-positive verdict rejected.
Audited by: codex