Web3 Daily

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 3:19 AM UTC
• Version: 2.1.1

Overview

This skill is a disclosed Web3 news digest that makes a single public API request and does not request credentials, local files, persistence, or account-changing authority.

Before installing, consider using a pinned or verified install method instead of the README's unpinned npx command. When using the skill, remember that the digest and links come from an external Web3 backend and may include market commentary; do not treat it as investment advice or follow wallet, credential, or transfer instructions from returned content.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:42
• Finding: Unpinned npx Installer Creates a Supply-Chain Execution Risk## Vulnerability Details **File Location**: `README.md:42` and `README.md:138` **Vulnerability Type**: Unpinned executable third-party dependency **Risk Level**: Medium ### Vulnerable Code ```bash npx skills add alexander10011/web3-daily ``` The same installation command appears in both the quick-start and installation sections. ### Technical Analysis The documented installation process invokes the `skills` npm package through `npx` without specifying an exact package version or verifying package integrity. If the package is not already installed locally, `npx` may retrieve its current release from the configured npm registry and execute its CLI code. Consequently, the code executed during installation is not limited to the repository reviewed in this audit. It can change independently after the skill has been audited. Compromise of the npm package, its publisher account, a transitive dependency, or the configured package registry could cause arbitrary code to run when a user follows the recommended installation instructions. The manually documented `git clone` alternatives do not present this particular `npx` execution path, although they also do not pin a commit. ### Attack Path 1. An attacker compromises the `skills` npm package, one of its executable dependencies, its publisher account, or the package source used by the victim. 2. The attacker publishes or serves a malicious version that retains plausible installation behavior. 3. A user follows the README and executes `npx skills add alexander10011/web3-daily`. 4. `npx` resolves and downloads the mutable package version. 5. The malicious CLI or package lifecycle code executes under the privileges of the user running the command. 6. The code can access resources available to that user before optionally completing the expected skill installation to reduce suspicion. ### Impact Assessment Successful exploitation permits arbitrary local code execution with th ...[truncated 559 chars]
• Remediation: ## Remediation Suggestions 1. Pin the installer to a specifically reviewed version, for example by using an exact package version rather than the latest registry resolution. 2. Publish and document the expected npm package publisher, version, and cryptographic integrity digest. 3. Use a lockfile or equivalent integrity-verification mechanism wherever the installation workflow supports it. 4. Avoid package lifecycle scripts unless they are strictly necessary, and document any code that the installer executes. 5. Prefer a non-executing installation method that downloads and verifies the skill package before placing it in the destination directory. 6. If Git installation remains supported, pin releases to signed tags or immutable commit hashes and provide signature-verification instructions. 7. Apply the remediation consistently to both occurrences at `README.md:42` and `README.md:138`.

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:75
• Finding: Remote Backend Content Is Reproduced Verbatim Without Trust-Boundary Validation## Vulnerability Details **File Location**: `SKILL.md:75-89` and `SKILL.md:99-117` **Vulnerability Type**: Untrusted remote content injected directly into agent output **Risk Level**: Medium ### Vulnerable Code ```markdown 2. **MUST EXECUTE** this curl command (do not skip or simulate): For Chinese output (default): ```bash curl -s -X POST "https://j4y-production.up.railway.app/api/v1/digest/public" \ -H "Content-Type: application/json" \ -d '{"language": "zh"}' ``` For English output: ```bash curl -s -X POST "https://j4y-production.up.railway.app/api/v1/digest/public" \ -H "Content-Type: application/json" \ -d '{"language": "en"}' ``` 3. Parse the JSON response and extract the `digest` field 4. Display the EXACT content from `digest` field to user (do not modify or summarize) ``` The compact workflow repeats the same trust pattern: ```markdown 3. Parse the JSON response and extract the `digest` field 4. Display the EXACT content from `digest` field to user ``` ### Technical Analysis The skill establishes the remote J4Y backend as an authoritative source of content and explicitly instructs the agent to reproduce the returned `digest` field without modification or summarization. No schema restrictions beyond selecting the field, content-length limit, markup sanitization, URL validation, provenance warning, or inspection for instruction-like content is specified. HTTPS protects the connection in transit but does not protect users from malicious content supplied by a compromised or malicious endpoint. The backend also aggregates numerous external news and social-media sources, creating an additional indirect-content trust boundary. If the backend, its hosting account, its generation pipeline, or an upstream data source is compromised, an attacker can place arbitrary prose, links, or instruction-like text in the `digest` value. The skill then directs the agent to present that material e ...[truncated 1918 chars]
• Remediation: ## Remediation Suggestions 1. Explicitly classify every API response as untrusted external data rather than agent instructions. 2. Remove the requirement to reproduce the `digest` field blindly and verbatim. 3. Validate the complete response against a strict schema, including expected types, maximum field lengths, allowed language values, and response-size limits. 4. Sanitize rendered Markdown and reject dangerous URL schemes, hidden links, embedded HTML, and unexpected active content. 5. Detect and neutralize instruction-like text that asks the agent or user to disclose secrets, execute commands, transfer funds, connect wallets, or override prior constraints. 6. Clearly label the content as externally generated by the named backend and state that linked destinations have not been independently trusted. 7. Allow the agent to omit or warn about suspicious content rather than requiring exact reproduction. 8. Restrict links to validated HTTPS destinations where practical and display their actual hostnames. 9. Apply the same controls to both `/digest/public` and `/digest/compact`. 10. Consider signed API responses or authenticated content manifests to reduce the risk of unauthorized backend-content modification, while retaining content-level validation because signatures do not make malicious source content safe.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: The README instructs users to run `npx skills add alexander10011/web3-daily` without pinning a specific package version. `npx` resolves the latest available package at execution time, so a compromised upstream package, typo-squatted dependency, or malicious future release could cause users to execute unreviewed code during installation. Because this is an install command in documentation for a network-enabled skill, the exposure is real even though the README itself contains no executable payload.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: This repeated one-line install command again uses unpinned `npx skills`, which means installation behavior depends on whatever package version is current at runtime. If the package supply chain is compromised, users following the README could execute attacker-controlled code before the skill is even installed. The repetition increases the chance users will copy-paste it, making the risk more operationally relevant.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger list includes broad natural-language phrases such as 'crypto news' and 'What's happening in crypto today', which can cause the skill to activate in normal conversation without a clear user request to invoke this specific external service. Because the skill has network permission and is designed to fetch remote content, unintended invocation can lead to unnecessary outbound requests and unreviewed third-party content being surfaced to the user.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Workflow A: Full Digest (Default)

### ⚠️ CRITICAL: You MUST execute the curl command below. DO NOT generate fake/simulated content.

**Steps**:

• Confidence: 94% confidence
• Finding: The skill mandates sending a network request to a third-party backend and instructs the agent to display the returned 'digest' exactly, without modification. This creates two risks: external transmission occurs whenever the skill is invoked, and untrusted remote content is passed through directly to the user, reducing opportunities for safety screening, sanitization, or contextual validation.

Natural-Language Policy Violations

Medium

• Confidence: 99% confidence
• Finding: Defaulting to Chinese when the user's language is unclear forces a locale choice without explicit consent and can result in unexpected content delivery. While this is not a direct security compromise, it increases the chance of user confusion and accidental data transfer to the backend under assumptions the user did not make.

Natural-Language Policy Violations

Medium

• Confidence: 82% confidence
• Finding: The content is explicitly divided into 'Chinese Circle' and 'English Circle', which reflects a fixed language/locale framing in the skill output. Under the policy, locale-specific behavior should either be user-selectable or clearly justified as region-specific; this sample provides neither.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: The manifest declares that "language_preference" is sent to an external API, but nowhere in this file does it indicate that the user can choose or opt in to the language/locale used. Because policy violations include forcing a specific language or locale without user opt-in, this undeclared locale handling is a natural-language policy concern.

Static analysis

No suspicious patterns detected.