T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:151- Finding
Transaction-capable workflows can be deployed and executed without a mandatory final approval gate
- Content
View full analysis
- Remediation
View remediation
Security audit
K3 Blockhain Agent Skill
Security checks for vulnerabilities and agentic risk
Overview
The skill is coherent for K3 blockchain automation, but it gives agents authority to deploy and manually run workflows that can trade, transfer tokens, or write contracts without a mandatory user approval checkpoint.
Review this skill carefully before installing. It is not deceptive or locally executable, but it can guide an agent to create persistent K3 automations that send data to third parties and perform blockchain actions. Require an explicit final review before deployment, use testnet or limited-fund wallets for any trading or contract-writing workflow, verify recipients and webhook/API destinations, protect API keys and bot tokens, and make sure scheduled workflows can be paused or revoked.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The trigger text is extremely broad and explicitly says to invoke the skill for a wide range of generic blockchain, crypto, DeFi, monitoring, and automation phrases, including vague requests like 'monitor this wallet' or 'track this token.' That creates a real risk of over-invocation, causing the agent to enter a workflow-building/deployment path in conversations where the user did not clearly consent to using K3 or to performing potentially external actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill guides the agent to generate, deploy, execute, and verify workflows that can send notifications and even perform on-chain actions such as swaps or contract writes, but it does not require a prominent user-facing warning or explicit confirmation before side effects occur. In this context, silent progression from planning to deployment/execution can lead to unintended external messages, scheduled automations, or blockchain transactions with financial consequences.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This reference documents trading, token transfer, and smart-contract write capabilities without explicit warnings that these actions can move assets, incur irreversible on-chain transactions, and cause direct financial loss if configured incorrectly or triggered by untrusted inputs. In a workflow-building skill aimed at automation, normalizing these capabilities without strong guardrails increases the chance that users or downstream agents will compose unsafe automations that execute real asset-moving actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The web scraping workflow pattern encourages automated extraction from websites without any guidance on respecting site terms of service, robots directives, rate limits, privacy constraints, or downstream handling of scraped content. In a blockchain/DeFi monitoring skill, users may target governance forums, protocol sites, or other third-party services at scale, creating legal, privacy, and operational abuse risks that the pattern currently normalizes.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The file describes external API writes, storage, email/Telegram/Slack delivery, and MCP integrations that transmit data and use credentials, but it does not warn about data leakage, secret handling, or the trust boundary created by third-party services. Because this skill is specifically designed to orchestrate cross-service blockchain workflows, users may send wallet data, prompts, reports, or credentials to external systems without understanding the privacy and security implications.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
This markdown file advises users to add API keys in headers and later to verify a Telegram bot token, but it does not include any warning about protecting secrets, avoiding accidental exposure, or using secure storage. Because markdown files should warn about behaviors that could affect privacy or system integrity, the omission is a minor safety disclosure gap.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The section explains how to restore outbound notifications through email, Telegram, and webhooks, which can transmit workflow data to third-party services. The document does not warn users to verify recipients, review payload contents, or consider privacy implications before sending notifications.
- Content
Static analysis
No suspicious patterns detected.