Security audit

Gotchi Finder

Security checks for vulnerabilities and agentic risk

Overview

This skill is a read-only Aavegotchi lookup and image-generation utility, with some documentation overclaims and auxiliary scripts that should be treated cautiously.

Install only if you are comfortable running npm dependencies and making public network requests for gotchi IDs. Prefer the documented show-gotchi.sh or find-gotchi.sh paths, avoid relying on the self-declared approval/zero-risk claims, and treat the auxiliary test and aging scripts as experimental unless reviewed further.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/fetch-with-aging.js:25
Finding: GraphQL Injection Through an Unvalidated Gotchi Identifier
Content: View full analysis
Remediation: View remediation
'); process.exit(1); } ``` 2. Enforce a reasonable numeric range and reject values that cannot be represented safely. 3. Use GraphQL variables rather than constructing the document with interpolation: ```js const query = ` query GetAavegotchi($id: ID!) { aavegotchi(id: $id) { id name createdAt claimedAt hauntId baseRarityScore modifiedRarityScore } } `; const data = JSON.stringify({ query, variables: { id: gotchiId } }); ``` 4. Add request timeouts, response-size limits, HTTP status validation, and GraphQL error handling to reduce denial-of-service exposure. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/get-birth-block.js:5
Finding: GraphQL Injection in Birth-Block Lookup
Content: View full analysis
'); process.exit(1); } getBirthBlock(tokenId).then(result => { ``` ### Technical Analysis The script checks only that an argument exists. It does not ensure that the supplied identifier is numeric or escape it before placing it inside a GraphQL string literal. Consequently, a caller can supply quotation marks and GraphQL syntax that alter the structure of the outbound query. The resulting attacker-influenced document is sent to the hardcoded public Goldsky subgraph. ### Attack Path 1. A caller invokes `get-birth-block.js` with crafted GraphQL syntax as the token ID. 2. The existence check accepts the argument. 3. The value is inserted verbatim into the `aavegotchi(id: "...")` expression. 4. The script serializes and sends the altered query to the public subgraph. 5. The remote endpoint processes the injected query if it is syntactically valid, and the script buffers and prints the response. ### Impact Assessment An attacker can make the Skill send queries outside the intended birth-block lookup shape. This may expose additional public subgraph data, create expensive operations, consume response-processing resources, or facilitate abuse of the third-party service. No secret credentials are attached to the request, and no evidence indicates access to private blockchain or local system data. The ob ...[truncated 118 chars]
Remediation: View remediation
'); process.exit(1); } ``` 2. Replace interpolation with a typed GraphQL variable: ```js const query = ` query GetBirthBlock($id: ID!) { aavegotchi(id: $id) { id createdAt createdBlockNumber timesTraded } } `; const data = JSON.stringify({ query, variables: { id: tokenId } }); ``` 3. Check the HTTP status and GraphQL `errors` field before returning data. 4. Configure a request timeout and a maximum accepted response size. 5. Add tests using quotation marks, braces, fragments, and additional operations to confirm that malformed identifiers are rejected locally. ]]>

T08 · Insecure Dependencies

Note

Location: package.json:17
Finding: Non-Reproducible Dependency Installation Using Mutable Version Ranges
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (30)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The finding indicates a chain/source mismatch: the skill claims Base mainnet but may use a Polygon subgraph API, along with hardcoded test queries and incomplete field retrieval. This is particularly dangerous because users may make decisions based on incorrect chain data provenance, and the combination of mislabeling plus external API dependence can produce silently wrong results while the document aggressively asserts zero risk and approval status.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The finding indicates a chain/source mismatch: the skill claims Base mainnet but may use a Polygon subgraph API, along with hardcoded test queries and incomplete field retrieval. This is particularly dangerous because users may make decisions based on incorrect chain data provenance, and the combination of mislabeling plus external API dependence can produce silently wrong results while the document aggressively asserts zero risk and approval status.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The finding indicates a chain/source mismatch: the skill claims Base mainnet but may use a Polygon subgraph API, along with hardcoded test queries and incomplete field retrieval. This is particularly dangerous because users may make decisions based on incorrect chain data provenance, and the combination of mislabeling plus external API dependence can produce silently wrong results while the document aggressively asserts zero risk and approval status.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The finding indicates a chain/source mismatch: the skill claims Base mainnet but may use a Polygon subgraph API, along with hardcoded test queries and incomplete field retrieval. This is particularly dangerous because users may make decisions based on incorrect chain data provenance, and the combination of mislabeling plus external API dependence can produce silently wrong results while the document aggressively asserts zero risk and approval status.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The finding indicates a chain/source mismatch: the skill claims Base mainnet but may use a Polygon subgraph API, along with hardcoded test queries and incomplete field retrieval. This is particularly dangerous because users may make decisions based on incorrect chain data provenance, and the combination of mislabeling plus external API dependence can produce silently wrong results while the document aggressively asserts zero risk and approval status.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The finding indicates a chain/source mismatch: the skill claims Base mainnet but may use a Polygon subgraph API, along with hardcoded test queries and incomplete field retrieval. This is particularly dangerous because users may make decisions based on incorrect chain data provenance, and the combination of mislabeling plus external API dependence can produce silently wrong results while the document aggressively asserts zero risk and approval status.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The finding indicates a chain/source mismatch: the skill claims Base mainnet but may use a Polygon subgraph API, along with hardcoded test queries and incomplete field retrieval. This is particularly dangerous because users may make decisions based on incorrect chain data provenance, and the combination of mislabeling plus external API dependence can produce silently wrong results while the document aggressively asserts zero risk and approval status.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The finding indicates a chain/source mismatch: the skill claims Base mainnet but may use a Polygon subgraph API, along with hardcoded test queries and incomplete field retrieval. This is particularly dangerous because users may make decisions based on incorrect chain data provenance, and the combination of mislabeling plus external API dependence can produce silently wrong results while the document aggressively asserts zero risk and approval status.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The finding indicates a chain/source mismatch: the skill claims Base mainnet but may use a Polygon subgraph API, along with hardcoded test queries and incomplete field retrieval. This is particularly dangerous because users may make decisions based on incorrect chain data provenance, and the combination of mislabeling plus external API dependence can produce silently wrong results while the document aggressively asserts zero risk and approval status.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The finding indicates a chain/source mismatch: the skill claims Base mainnet but may use a Polygon subgraph API, along with hardcoded test queries and incomplete field retrieval. This is particularly dangerous because users may make decisions based on incorrect chain data provenance, and the combination of mislabeling plus external API dependence can produce silently wrong results while the document aggressively asserts zero risk and approval status.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The finding indicates a chain/source mismatch: the skill claims Base mainnet but may use a Polygon subgraph API, along with hardcoded test queries and incomplete field retrieval. This is particularly dangerous because users may make decisions based on incorrect chain data provenance, and the combination of mislabeling plus external API dependence can produce silently wrong results while the document aggressively asserts zero risk and approval status.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The finding indicates a chain/source mismatch: the skill claims Base mainnet but may use a Polygon subgraph API, along with hardcoded test queries and incomplete field retrieval. This is particularly dangerous because users may make decisions based on incorrect chain data provenance, and the combination of mislabeling plus external API dependence can produce silently wrong results while the document aggressively asserts zero risk and approval status.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The implementation materially differs from the skill description: it fetches portal SVGs by status and haunt ID rather than fetching an Aavegotchi by token ID with full traits and image rendering behavior. In an agent skill ecosystem, this mismatch is security-relevant because users or downstream agents may trust the manifest to decide what data the skill accesses and displays, enabling deceptive or misleading behavior under false pretenses.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 96% confidence
Finding: The skill advertises shell and environment-driven behavior but does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization and review gap: an agent may execute shell commands or access environment variables without a clearly bounded contract, increasing the chance of unintended command execution or exposure of RPC endpoints and other sensitive runtime data.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest says the skill fetches an Aavegotchi by ID from Base mainnet, renders its on-chain SVG to PNG, and displays full traits. This file instead computes an age-based bonus from timestamps and returns a helper function, with no logic to fetch gotchi metadata, render SVG, convert images, or display traits.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The comments describe finding the birth timestamp by querying mint/Transfer events, but the function never uses the provided tokenId, never performs an event query, and ultimately just returns a closure that requires an externally supplied birthTimestamp. This is an active contradiction between the stated intent in comments and the actual implementation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script behavior does not match the stated skill purpose: it queries a centralized website API instead of retrieving data from Base mainnet on-chain sources. This creates an integrity and trust problem because users may believe they are seeing canonical on-chain data when the result is actually whatever the remote API returns, and availability/privacy also become dependent on that third-party service.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 89% confidence
Finding: The script transmits user-supplied gotchi identifiers to an external domain, creating a privacy and dependency boundary outside the local skill. In this skill context, outbound network access is expected, but it is still security-relevant because the external service can log requests, return misleading data, or become unavailable, especially since the skill claims on-chain sourcing rather than a website API.
Content: Scanner excerpt · scripts/fetch-from-website-api.sh (reported line 13)May include surrounding context.
sh
echo "Fetching gotchi #$GOTCHI_ID from Aavegotchi API..." # Try the official API endpoint curl -s "https://api.aavegotchi.com/v1/aavegotchi/${GOTCHI_ID}" \ -H "Accept: application/json" | jq .

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest description promises on-chain SVG display, PNG conversion, and presentation of complete gotchi stats. In this file, the implementation saves JSON and SVG files locally and logs some trait fields, but there is no PNG conversion or image display logic at all.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest says the skill 'converts to PNG, and displays' the on-chain SVG. In this file, the implementation writes metadata JSON and the SVG to disk, but performs no PNG conversion and no display/rendering logic. This is a direct mismatch between the advertised behavior and the implemented behavior.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code omits the manifest-promised PNG conversion and full trait/stat display, so consumers may believe they are receiving richer processed output than the script actually provides. This discrepancy can mislead automation, break security assumptions about output format, and make it easier to substitute incomplete or unexpected data into downstream workflows.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest describes a skill focused on fetching an Aavegotchi by ID from Base, rendering its SVG/PNG image, and showing complete gotchi stats. This file instead adds separate behavior centered on querying a subgraph, calculating custom aging milestones, and reporting a derived 'full BRS (website)' metric, which goes beyond the stated image-and-traits retrieval scope.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/fetch-with-aging.js (reported line 6)May include surrounding context.
js
const https = require('https'); const SUBGRAPH_URL = 'https://api.goldsky.com/api/public/project_cm4b9xy95tko101tb1tyxaqw5/subgraphs/aavegotchi-core-base/1.0.0/gn'; async function getBirthBlock(tokenId) { const query = `

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/get-birth-block.js (reported line 3)May include surrounding context.
js
const https = require('https'); const SUBGRAPH_URL = 'https://api.goldsky.com/api/public/project_cm4b9xy95tko101tb1tyxaqw5/subgraphs/aavegotchi-core-base/1.0.0/gn'; async function getBirthBlock(tokenId) { const query = `

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/test-subgraph-fields.sh (reported line 4)May include surrounding context.
sh
#!/bin/bash # Query the Polygon subgraph first to see what fields exist curl -s -X POST https://api.thegraph.com/subgraphs/name/aavegotchi/aavegotchi-core-matic \ -H "Content-Type: application/json" \ -d '{ "query": "{ aavegotchi(id: \"1484\") { id name createdAt claimedAt gotchiId hauntId baseRarityScore modifiedRarityScore kinship level } }"

Static analysis

No suspicious patterns detected.