Blockchain Analysis

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:13 AM UTC
• Version: 0.4.0

Overview

The skill is mainly a Blockscout blockchain-analysis guide, but it asks agents to trust changing remote instructions and may install or enable tooling automatically, so users should review it before installing.

Install only if you are comfortable with the agent contacting Blockscout services and using this skill for broad blockchain-analysis tasks. Do not let the agent treat remote unlock output as higher-priority instructions, require explicit approval before installing or enabling MCP tooling, and keep any API keys or restricted-resource keys out of prompts, logs, URLs, and source files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:29
• Finding: Mandatory Retrieval of Mutable Remote Instructions## Vulnerability Details **File Location**: `SKILL.md`, lines 29-35 **Vulnerability Type**: Remote instruction redirection **Risk Level**: High ### Vulnerable Code Snippet ```markdown ### `unlock_blockchain_analysis` prerequisite Before calling any other Blockscout MCP tool, call `unlock_blockchain_analysis` once per session. It provides essential rules for blockchain data interactions that the agent must follow. - **Mandatory** for all MCP clients that do not reliably read the server's tool instructions. - **Optional** when running in Claude Code (which reads MCP server instructions correctly). - Do not copy or paraphrase the output of `unlock_blockchain_analysis` — it is maintained by the MCP server and may change. Only require calling it and point to the tool itself as the canonical source. ``` ### Technical Analysis The Skill requires the agent to invoke the externally hosted `unlock_blockchain_analysis` tool and treat its response as rules that “the agent must follow.” It also explicitly acknowledges that the response is remotely maintained and may change. This delegates part of the Skill's effective instruction set to mutable content that is not included in the audited package. Consequently, the behavior observed during static review may differ from the behavior presented to an agent later. Although remote blockchain data access is necessary for the declared functionality, granting externally returned content instructional authority is not necessary merely to query blockchain data. The package does contain safeguards for ordinary API responses elsewhere in `SKILL.md`, including treating blockchain and metadata fields as untrusted. Those safeguards do not resolve this issue because the prerequisite response is explicitly characterized as authoritative rules rather than untrusted data. ### Attack Path 1. A user activates the Skill for a Blockscout or blockchain-analysis task. 2. Before using another Blockscout tool, the Skill directs the agent to ...[truncated 1194 chars]
• Remediation: ## Remediation Suggestions 1. Remove the requirement that agents treat the output of `unlock_blockchain_analysis` as mandatory instructions. 2. Place all security-sensitive rules and workflow constraints directly in the versioned, auditable Skill package. 3. Treat every MCP response, including prerequisite or initialization responses, strictly as untrusted data that cannot override system, developer, user, or local Skill instructions. 4. If initialization is operationally required, constrain its response to a documented, machine-validated schema containing data only, such as supported API versions or capabilities. 5. Reject unexpected fields, free-form directives, embedded prompts, URLs, and executable content in initialization responses. 6. Pin the expected protocol and schema version, and fail closed when the response does not match it. 7. Apply an explicit tool allowlist and destination allowlist so a remote response cannot authorize unrelated network access or tools. 8. Log initialization metadata without recording secrets, and clearly inform the user when remote initialization is performed. 9. Add regression tests using hostile initialization responses to verify that remote text cannot modify agent policy or trigger additional actions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The activation criteria are so broad that the skill may be invoked for a very large class of blockchain-related tasks, effectively preempting more specific skills or normal agent behavior. Because this skill contains prescriptive execution rules, broad auto-activation increases the chance that users are funneled into unnecessary external service usage and environment changes without clear need.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The top-level description frames the skill as guidance for Blockscout MCP usage and blockchain data retrieval via Blockscout, while the body expands behavior to another external service, Chainscout, accessed through direct HTTP requests. It also introduces operational setup behavior beyond pure analysis guidance by directing installation or enablement of MCP tooling when unavailable.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: Authorizing the agent to automatically install or enable MCP tooling expands the skill from passive guidance into making environment-changing actions. In a hostile or sensitive environment, this can trigger unreviewed network access, configuration changes, or execution of newly introduced components, violating least privilege and increasing supply-chain and persistence risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation explicitly includes a `key` parameter described as a secret for accessing restricted resources, but provides no warning about credential sensitivity, storage, logging, or least-privilege handling. In an agent skill context, this omission can cause downstream agents or generated scripts to place secrets in URLs, logs, telemetry, shell history, or shared code, increasing the risk of credential disclosure and unauthorized access.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This file repeatedly documents many endpoints that accept a secret `key` for restricted resources without any accompanying warning or safe-handling guidance. Because this skill is mandatory before Blockscout MCP usage and script generation, the unsafe omission has amplified influence: it can normalize insecure patterns across many generated calls, leading to widespread leakage of privileged credentials.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation introduces a `key` parameter described as a secret for restricted resources but provides no warning about sensitive credential handling, storage, or exposure risks. In a skill that guides users to build scripts and call APIs, this omission can lead users to embed secrets in code, logs, URLs, or shared examples, increasing the chance of credential leakage.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Repeatedly documenting secret-key query parameters without accompanying warnings normalizes unsafe handling and increases the odds that users will propagate insecure patterns across multiple endpoints. Because this skill is explicitly mandatory before Blockscout API usage and script writing, unsafe documentation can systematically influence downstream implementations.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: Additional endpoint references continue to expose `key` as a query parameter for restricted resources without any warning, compounding the risk of accidental disclosure through browser history, proxies, analytics, and server logs. The surrounding skill context makes this more dangerous because it serves as authoritative implementation guidance for blockchain data tooling across chains.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation advertises a secret `key` parameter for restricted resources without any warning about secure handling, storage, or transmission. In the context of an agent skill that instructs users how to call Blockscout endpoints or generate scripts, this increases the chance that sensitive credentials will be hardcoded, logged, echoed in URLs, or otherwise exposed during normal use.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: This endpoint is documented as retrieving MUD table records, but the `sort` parameter description lists unrelated fields such as transaction value, fee, token holders, and circulating market cap. That actively contradicts the endpoint's stated purpose and would mislead an agent about what the API actually supports.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation explicitly mentions a `key` parameter as a secret used to access restricted resources, but provides no warning about secure handling, storage, or transmission. In a skill intended to guide blockchain data access and script creation, this omission can cause users or downstream agents to embed secrets in URLs, logs, source code, or shared examples, increasing the chance of credential disclosure and unauthorized access.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The documentation exposes the existence and intended use of a `key` secret-key query parameter without any warning about secure handling. In a skill that guides agents and users to build API calls and scripts, this increases the chance that secrets will be placed in URLs, logs, terminal history, analytics, or source code, leading to credential leakage and unauthorized access to restricted resources.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Repeatedly documenting a secret `key` as a normal query parameter across endpoints, without credential-safety warnings, normalizes insecure usage patterns. Because this skill is mandatory before Blockscout usage and may influence generated scripts across many endpoints, the omission can propagate insecure credential handling broadly and cause accidental secret exposure.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The documentation exposes the existence and names of sensitive credential parameters (`apikey` and especially `key`) without any accompanying warning that these values must be kept secret and must not be hardcoded, logged, or shared. In a skill intended to guide blockchain data retrieval and script creation, this omission can lead users or downstream agents to handle credentials unsafely, increasing the chance of accidental disclosure or misuse of restricted API access.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The documentation references an `apikey` for rate limiting or sensitive endpoints without any guidance that it should be treated as a credential. While API keys may be lower sensitivity than secret keys, users following this skill to write scripts may expose them in examples, command history, logs, or repositories, leading to quota abuse or unauthorized use of protected API functionality.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: This markdown file documents an endpoint that retrieves the current user's watchlist transactions, which is user-specific data. The description lists the endpoint and credential-like parameters but does not include any warning about privacy implications or that the call accesses personalized account data.

Intent-Code Divergence

Low

• Confidence: 94% confidence
• Finding: The documented path `/api/v2/tokens/{address_hash_param}/transfers` includes only a token contract address, but the description says it retrieves transfer history for a specific NFT instance. A specific instance would require a token ID, as reflected by the separate instance-scoped endpoints above, so this documentation contradicts the endpoint shape and likely intent.

Static analysis

No suspicious patterns detected.