T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/mint-via-bankr.sh:139- Finding
Unvalidated Network Endpoints Can Receive Bankr Credentials or User-Selected Media
- Content
View full analysis
- Remediation
View remediation
Security audit
superrare-mint
Security checks for vulnerabilities and agentic risk
Overview
The skill matches its NFT minting purpose, but it needs Review because it can reuse Bankr credentials and submit media or credential-bearing requests to configurable endpoints without strong destination controls.
Install only if you are comfortable with this skill uploading the media and metadata you select and using your Bankr API key to submit mint transactions. Prefer explicit command-line contract and deploy receipt paths, verify the printed contract and chain before broadcasting, keep API endpoints at the official defaults, and avoid running it in an environment where untrusted files can modify Bankr or SuperRare config.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill advertises shell and network-capable behavior but does not declare any explicit tool scope such as permissions or allowed-tools. In an agent environment, that weakens containment and makes it harder to restrict or review what the skill may invoke, especially since it performs uploads, API calls, and blockchain transaction submission.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md - If neither `receiver` nor `royaltyReceiver` is set, the skill calls `addNewToken(string)`. - If either receiver field is provided, the skill calls `mintTo(string,address,address)`. - If only one of `receiver` or `royaltyReceiver` is set, the other defaults to the same address. - Successful broadcasts write receipts into `receipts/`. ## Deploy receipt auto-resolution
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script searches for a Bankr API key and API URL in user-level locations outside this skill, including another skill's workspace and a global ~/.bankr config. That creates cross-skill trust and ambient credential access: running this skill may silently consume credentials intended for a different tool, and if an attacker can influence those files they can redirect API usage or cause unauthorized actions under the user's Bankr account.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The code accesses sensitive Bankr credentials from environment, systemd user environment, and external config files without any user-facing warning or consent step. In an agent skill context, that is especially risky because the operator may not realize this minting helper can reach beyond its own config and automatically leverage existing credentials to perform privileged API-backed actions.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The receipt resolver auto-discovers deploy receipts from sibling directories, another workspace skill, and the user's home directory, then uses the newest matching file. This can bind minting to the wrong collection or to attacker-planted metadata without an explicit user choice, especially in a multi-skill/shared-workspace environment where file placement influences behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This script uploads user-provided artwork and metadata by invoking
pin-metadata.mjswith an API base URL, but it does not present any explicit warning or confirmation that local files and descriptive content will be transmitted to a remote service. In a minting workflow this network transfer is expected, but the lack of a clear user-facing disclosure can still cause unintended publication of sensitive, private, or embargoed media.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh waitForConfirmation: true }')" RESPONSE="$(curl -sS --max-time "$BANKR_SUBMIT_TIMEOUT_SECONDS" -X POST "$BANKR_API_URL/agent/submit" \ -H "X-API-Key: $BANKR_API_KEY" \ -H "Content-Type: application/json" \ -d "$REQUEST_PAYLOAD")"
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The documented API key resolution searches systemd user environment and several external config locations beyond the skill directory. That broad secret discovery behavior expands the trust boundary and can cause the skill to consume credentials the operator did not intend to expose to this specific skill, increasing risk of secret misuse or accidental cross-skill credential access.
- Content