Ethereum Node

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:52 PM UTC
• Version: 0.1.0

Overview

This skill is a coherent Ethereum node administration guide, with expected local node commands and no evidence of hidden exfiltration or deception.

Install only trusted Ethereum clients, prefer pinned or verified releases for reth, and keep admin/debug RPC namespaces bound to localhost. Do not expose port 8545 or admin APIs to the public network.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Unpinned Git Dependency Installation in Skill Documentation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 20
Vulnerability Type: Unpinned dependency retrieved from a mutable Git branch
Risk Level: Medium

Vulnerable Code:

bash

cargo install reth --git https://github.com/paradigmxyz/reth --locked

Technical Analysis

The installation command retrieves and compiles reth from the Git repository's current default branch without specifying an immutable commit. The --locked option enforces the repository's Cargo lockfile for transitive Rust dependencies, but it does not pin the source repository itself.

Consequently, the source code installed by this command can change after the Skill has been reviewed. If the upstream repository, maintainer account, or default branch is compromised, users following this instruction may compile and execute attacker-controlled source or build logic.

Attack Path

1. An attacker compromises the upstream repository, a maintainer account, or a mechanism capable of modifying its default branch.
2. The attacker introduces malicious Rust source code or build-time behavior.
3. A user follows the installation command from SKILL.md.
4. Cargo retrieves the current malicious revision because no commit is pinned.
5. Cargo compiles the retrieved project, potentially executing malicious build scripts during installation.
6. The resulting binary or build logic executes with the privileges of the user running Cargo.

Impact Assessment

Successful exploitation can provide code execution under the installing user's account. The attacker could access files and credentials available to that account, modify user-owned data, tamper with Ethereum node operations, or install additional user-level payloads. Administrative privileges are not inherently obtained unless the command is separately run from a privileged account.

Remediation

View remediation

Remediation Suggestions

Pin the Git dependency to a reviewed, immutable full commit hash:

bash

cargo install reth \
  --git https://github.com/paradigmxyz/reth \
  --rev FULL_REVIEWED_COMMIT_HASH \
  --locked

Prefer a verified release from a trusted package distribution channel when available. Document the expected release version and commit hash, verify upstream release signatures where supported, and require security review before updating the pinned revision. For stronger assurance, build in an isolated environment and verify the resulting artifact against a published checksum or reproducible-build record.

T08 · Insecure Dependencies

Warning

• Location: README.md:8

Finding

Unpinned Git Dependency Installation in Quick-Start Documentation

Content

View full analysis

Vulnerability Details

File Location: README.md, line 8
Vulnerability Type: Unpinned dependency retrieved from a mutable Git branch
Risk Level: Medium

Vulnerable Code:

bash

cargo install reth --git https://github.com/paradigmxyz/reth --locked

Technical Analysis

The quick-start command installs directly from the repository's mutable default branch. Although --locked constrains transitive dependencies to the versions recorded in Cargo.lock, it does not constrain the repository checkout to the version that was reviewed during this audit.

This creates a supply-chain boundary in which the effective installation payload can change without any corresponding change to this project. Malicious source code or Cargo build scripts introduced upstream could therefore execute when a user follows the documented command.

Attack Path

1. An attacker gains the ability to alter the upstream repository's default branch.
2. Malicious source code or build-time logic is committed to that branch.
3. A user copies and runs the quick-start installation command.
4. Cargo resolves the unpinned repository to the attacker-controlled revision.
5. Malicious build logic runs during compilation, or the installed binary executes malicious behavior when invoked.
6. The payload operates with the permissions of the installing or executing user.

Impact Assessment

Exploitation may result in arbitrary code execution within the installing user's privilege boundary. This can expose user-accessible secrets and node configuration, permit modification or destruction of user-owned files, and compromise the integrity or availability of Ethereum node operations. System-level compromise would require the installation or resulting binary to be run with elevated privileges or to exploit another privilege boundary.

Remediation

View remediation

Remediation Suggestions

Replace the mutable Git installation with an immutable, reviewed revision:

bash

cargo install reth \
  --git https://github.com/paradigmxyz/reth \
  --rev FULL_REVIEWED_COMMIT_HASH \
  --locked

Keep the pinned revision synchronized with the value in SKILL.md to prevent documentation drift. Record the associated release version and expected checksum, validate signed upstream releases where possible, and review dependency changes before updating the revision. Avoid recommending privileged installation unless it is strictly necessary.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 16)May include surrounding context.

reth node --http --http.addr 127.0.0.1 --http.api eth,net,web3 &> reth.log 2>&1 &

Check sync status

curl -s -X POST http://localhost:8545
-H "Content-Type: application/json"
-d '{"jsonrpc":"2.0","method":"eth_syncing","id":1}' | jq

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

reth node --http --http.addr 127.0.0.1 --http.api eth,net,web3 &> reth.log 2>&1 &

Check sync status

curl -s -X POST http://localhost:8545
-H "Content-Type: application/json"
-d '{"jsonrpc":"2.0","method":"eth_syncing","id":1}' | jq

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

reth node --http --http.addr 127.0.0.1 --http.api eth,net,web3 &> reth.log 2>&1 &

Check sync status

curl -s -X POST http://localhost:8545
-H "Content-Type: application/json"
-d '{"jsonrpc":"2.0","method":"eth_syncing","id":1}' | jq

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 73% confidence

Finding

This command invokes admin_addPeer, which changes node connectivity and accepts a user-supplied enode target. In an agent skill context, this can be risky because it enables state-changing network interaction and could connect the node to attacker-controlled peers if the input is not validated or if the admin namespace is exposed beyond localhost.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

Add a peer manually:

bash

curl -s -X POST http://localhost:8545 \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"admin_addPeer","params":["enode://PUBKEY@IP:PORT"],"id":1}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

bash

# Chain ID (hex)
curl -s -X POST http://localhost:8545 \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"eth_chainId","id":1}'

Static analysis

No suspicious patterns detected.