T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:31- Finding
Overbroad Access to Sensitive Credential Stores
- Content
View full analysis
- Remediation
View remediation
Security audit
Blockscout for Web3 Dev
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly coherent for Blockscout API development, but it tells agents to search broad credential stores and reuse live API credentials in ways users should review first.
Review before installing. Use this skill only when you intentionally want Blockscout PRO API integration, and prefer providing the exact BLOCKSCOUT_PRO_API_KEY location yourself. Avoid allowing automatic searches of Keychain, CI secrets, persistent agent memory, or broad project secret files unless you have checked what the agent can access.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (28)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `references/pro-api.json` | Full OpenAPI v3 specification (~24,000 lines). **Do not read whole** — query it with `oastools`. |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `references/pro-api.json` | Full OpenAPI v3 specification (~24,000 lines). **Do not read whole** — query it with `oastools`. |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `references/pro-api.json` | Full OpenAPI v3 specification (~24,000 lines). **Do not read whole** — query it with `oastools`. |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `references/pro-api.json` | Full OpenAPI v3 specification (~24,000 lines). **Do not read whole** — query it with `oastools`. |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `references/pro-api.json` | Full OpenAPI v3 specification (~24,000 lines). **Do not read whole** — query it with `oastools`. |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `references/pro-api.json` | Full OpenAPI v3 specification (~24,000 lines). **Do not read whole** — query it with `oastools`. |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `references/pro-api.json` | Full OpenAPI v3 specification (~24,000 lines). **Do not read whole** — query it with `oastools`. |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `references/pro-api.json` | Full OpenAPI v3 specification (~24,000 lines). **Do not read whole** — query it with `oastools`. |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `references/pro-api.json` | Full OpenAPI v3 specification (~24,000 lines). **Do not read whole** — query it with `oastools`. |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `references/pro-api.json` | Full OpenAPI v3 specification (~24,000 lines). **Do not read whole** — query it with `oastools`. |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `references/pro-api.json` | Full OpenAPI v3 specification (~24,000 lines). **Do not read whole** — query it with `oastools`. |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `references/pro-api.json` | Full OpenAPI v3 specification (~24,000 lines). **Do not read whole** — query it with `oastools`. |
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest description includes very broad trigger phrases such as 'build a web3 app', 'wallet history', and 'index/query on-chain data', which can cause this skill to activate for many generic blockchain-development requests. Over-broad auto-invocation increases the chance that the agent is steered into networked API usage and credential-handling behaviors when a narrower or safer skill would have been more appropriate.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
The skill explicitly directs the agent to search the environment, project-local secret files, and persistent profile memory for API keys, and to reuse stored secrets after only lightweight confirmation. That materially expands the agent's autonomy around credential discovery and use, increasing the risk of unauthorized secret access or cross-project secret leakage if the surrounding platform permissions are broad.
- Content
md - A project-local secrets file appropriate to the artefact: `.env` for Node/Python apps, `.env.local` for Next.js, `local.properties` for Android, `*.xcconfig` or Keychain for iOS, `secrets.toml` for some Python frameworks, a CI secret store, etc. - A key the user previously placed in the agent's stored memory or persistent profile (e.g. a saved-secrets/preferences store the agent has access to across sessions). **Do not ask the user to paste the key into the conversation.** A pasted value lands in the LLM transcript and can leak via provider logs, exported chats, screenshots, or training corpora. Steer the user to `export` or a gitignored `.env` instead (see step 5). 2. **Never invent or guess a key.** If the agent has no record of one, do not fabricate one or pull one from training data. 3. **Confirm before reusing a key from stored memory or a prior session.** A key the user has intentionally saved is a legitimate source — but reusing it silently is not. Before issuing the first request with such a key, show the user *which* stored key the agent intends to use (e.g. "the key saved as `BLOCKSCOUT_PRO_API_KEY` in your agent profile, last 4 chars `…abcd`") and ask them to confirm. Never echo the full key value back. Keys found in the current session's environment or project secrets file do not need this extra confirmation step — they are by construction intentional for the current task. 4. If a key is found (and confirmed where required by step 3), validate loosely — it should start with `proapi_` — and proceed.
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 88% confidence
- Finding
This section normalizes the agent making live research and debug calls on its own once a key is available, rather than restricting network activity to clearly user-authorized actions. In a skill with broad triggers, that autonomy can lead to unreviewed external requests, unintended credit consumption, and transmission of user-related query data without sufficiently granular consent.
- Content
md The reason this is a hard interrupt — not just discipline — is that **the agent needs the key for its own research and debug calls**, not only for the user's eventual code. Probing an endpoint to confirm its real response shape, validating a parameter combination by trying it, and debugging why a previous call returned unexpected data are all live PRO API calls the agent makes during planning and iteration. Without a key, the agent cannot do that exploratory work, which means it cannot reliably design the user's code in the first place. "Build the script now, run it later when the key arrives" therefore produces code that was never validated against the actual API. Send a brief message that (a) names the missing key, (b) points the user at **https://dev.blockscout.com** (free tier, no credit card), and (c) offers two paste-free paths: `export BLOCKSCOUT_PRO_API_KEY=proapi_…` in the current shell, or a gitignored `.env` in the project root. **Do not ask the user to paste the key into the conversation** — that puts the value in the LLM transcript. Then wait. - ❌ Wrong: *"No API key found in environment. Let me check the endpoint parameters and build the script — it'll use the Blockscout PRO API for token transfers (when a key is available)."* - ✅ Right: *"I couldn't find a Blockscout PRO API key. Generate one at https://dev.blockscout.com (free tier, no credit card), then either run `export BLOCKSCOUT_PRO_API_KEY=proapi_…` in this shell, or add it to a gitignored `.env` in the project root. The value won't appear in our conversation either way. Tell me when you're done."*
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
text https://api.blockscout.com + /1/api/v2/blocks/10000000 = https://api.blockscout.com/1/api/v2/blocks/10000000Strict rules for path construction — these prevent the most common integration bugs:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
text https://api.blockscout.com + /1/api/v2/blocks/10000000 = https://api.blockscout.com/1/api/v2/blocks/10000000Strict rules for path construction — these prevent the most common integration bugs:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
text https://api.blockscout.com + /1/api/v2/blocks/10000000 = https://api.blockscout.com/1/api/v2/blocks/10000000Strict rules for path construction — these prevent the most common integration bugs:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
text https://api.blockscout.com + /1/api/v2/blocks/10000000 = https://api.blockscout.com/1/api/v2/blocks/10000000Strict rules for path construction — these prevent the most common integration bugs:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
text https://api.blockscout.com + /1/api/v2/blocks/10000000 = https://api.blockscout.com/1/api/v2/blocks/10000000Strict rules for path construction — these prevent the most common integration bugs:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
text https://api.blockscout.com + /1/api/v2/blocks/10000000 = https://api.blockscout.com/1/api/v2/blocks/10000000Strict rules for path construction — these prevent the most common integration bugs:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
text https://api.blockscout.com + /1/api/v2/blocks/10000000 = https://api.blockscout.com/1/api/v2/blocks/10000000Strict rules for path construction — these prevent the most common integration bugs:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
text https://api.blockscout.com + /1/api/v2/blocks/10000000 = https://api.blockscout.com/1/api/v2/blocks/10000000Strict rules for path construction — these prevent the most common integration bugs:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
text https://api.blockscout.com + /1/api/v2/blocks/10000000 = https://api.blockscout.com/1/api/v2/blocks/10000000Strict rules for path construction — these prevent the most common integration bugs:
Context Window Stuffing
Medium
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
- Content
md ## Handling response verbosity PRO API responses are explorer-enriched and can be hundreds of KB — a single transaction's logs, an enriched address page, a paginated list of token transfers. **Dumping a raw response into the agent's reading will exhaust the context window**, so apply the same "never read whole, project narrowly" discipline you apply to `pro-api.json`. Two recipes: - **You know what you need** → pipe `curl` through `jq` with the smallest projection that satisfies the task: `curl … | jq '{n: .height, t: .timestamp}'`. Drop heavy fields you don't need (decoded calldata, NFT metadata, raw input bytes). - **You're exploring or debugging an unfamiliar response** → first inspect the *schema* with `oastools walk responses` (zero credits, bounded), or save the response to disk with `curl -o /tmp/r.json` and probe it with `wc -c r.json`, `jq 'keys'`, `jq '.items[0] | keys'`, or `head -c 1000` — never `cat` the file or read it whole. Saving to disk lets you re-probe without re-fetching, but the budget rule is unchanged: only narrow projections reach the conversation.