Security audit

Baozi Prediction Markets

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for Baozi prediction-market use, but it asks users to run mutable third-party code in a financial workflow and automatically registers a wallet-based affiliate code without clear opt-in.

Review this before installing. Use only a pinned and reviewed version of the Baozi MCP server, run it in a restricted environment with no private keys or seed phrases, verify every transaction before signing, and do not proceed unless you are comfortable with wallet-address affiliate registration or can disable it.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

Location: SKILL.md:42
Finding: Unpinned Third-Party Package Is Downloaded and Executed Through npx
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (8)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The skill instructs use of an unpinned MCP package via npx @baozi.bet/mcp-server, which fetches whatever version is current at execution time. That creates a supply-chain risk: a compromised publisher account, malicious update, or breaking change could cause the agent to run unreviewed code in a high-risk financial workflow involving quotes, wallet positions, and transaction construction.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This invocation again relies on an unpinned npx package, allowing remote code changes outside the skill author's control. Because the package is used to enumerate market data in a betting context, any package compromise could mislead decisions, exfiltrate environment data, or tamper with downstream transaction-related behavior.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: Using npx @baozi.bet/mcp-server without version pinning means the executed tool is mutable and can change between runs. In a crypto prediction-market skill, that materially increases risk because the tool may influence financial actions and could be swapped for malicious code or altered logic.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The skill repeats a floating MCP dependency for wallet-position queries, exposing users to supply-chain compromise and unexpected behavior changes. Since wallet-related operations are especially sensitive, executing unpinned remote package code is dangerous even if private keys are not directly handled by the agent.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This unpinned MCP invocation for market analysis carries the same supply-chain risk as the others: arbitrary upstream updates may introduce malicious behavior or silent output manipulation. In a financial analysis context, even data or recommendation tampering can cause direct economic loss.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: Another unpinned npx execution appears in a skill that can lead to live betting once an environment flag is enabled. The combination of mutable remote code and transaction-building functionality makes the issue more dangerous than in a read-only context, because compromised code could alter quotes, destinations, or transaction contents presented for signature.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill states that on first use it automatically checks for and registers an affiliate code using the user's wallet address, but it does not require an explicit warning or consent step. That creates a transaction/identity side effect the user may not expect, potentially linking their wallet to an affiliate program, changing on-chain state, and exposing them to privacy, compliance, or trust issues.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Automatically registering an affiliate code derived from the user's wallet address without opt-in is a genuine unsafe behavior, not just a documentation issue. In this crypto context, wallet addresses are durable identifiers, so forced affiliate enrollment can create unwanted attribution, privacy leakage, and possible financial or reputational consequences if users are enrolled without informed consent.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.