Onchain Test

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:46 AM UTC
• Version: 0.1.2

Overview

The skill's crypto features are coherent, but it asks agents to use sensitive wallet and exchange data through an unpinned external CLI without enough privacy or credential-safety guidance.

Review before installing. Pin and verify the npm package, prefer an isolated environment, use only read-only minimally scoped exchange API keys, never enable withdrawals, and assume wallet addresses, portfolio data, and exchange history may be sent to the listed third-party providers.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:7

Finding

Unpinned Third-Party Package Installation and Execution

Content

View full analysis

Vulnerability Details

File Location: README.md:7-14
Vulnerability Type: Unverified and unpinned npm supply-chain dependency
Risk Level: Medium

The project instructs users to install or directly execute an external npm package:

bash

npm install -g @cyberdrk/onchain

Or run directly with npx:

bash

npx @cyberdrk/onchain price btc

Technical Analysis

Both commands retrieve executable code from the npm registry without pinning an exact reviewed version or verifying an integrity digest. The npx command can download and immediately execute the currently resolved package release. Global installation also places unreviewed package code in the user's global npm environment.

The audited project contains only README.md and SKILL.md; it does not include the CLI source code, a package manifest, a lockfile, integrity hashes, or vendored dependencies. Consequently, the behavior and dependency graph of @cyberdrk/onchain cannot be verified from this artifact. There is no evidence that the referenced package is currently malicious, but the documented installation procedure exposes users to package-account compromise, malicious updates, dependency compromise, or unexpected behavior introduced by a newer release.

The risk is elevated because the documented CLI processes Coinbase and Binance API credentials and reads configuration from locations such as ~/.config/onchain/config.json5.

Attack Path

1. An attacker compromises the npm publisher account, the package itself, or one of its transitive dependencies.
2. The attacker publishes a malicious release under the referenced package name.
3. A user or agent follows the documentation and runs the unpinned npm install -g or npx command.
4. npm resolves and downloads the attacker-controlled release.
5. Malicious package code or lifecycle scripts execute with the privileges of the invoking user.
6. The code can attempt to read accessibl ...[truncated 791 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin installation instructions to an exact, reviewed package version rather than resolving the latest release.
2. Publish the CLI source code, package.json, lockfile, and build instructions so its implementation and transitive dependencies can be audited.
3. Provide and verify package integrity information and npm provenance attestations for published releases.
4. Audit or disable npm lifecycle scripts where possible, for example by reviewing the package before installation and using --ignore-scripts when lifecycle scripts are unnecessary.
5. Avoid global installation where practical. Run the CLI in an isolated, least-privileged environment with narrowly restricted filesystem and network access.
6. Require read-only, minimally scoped exchange API keys. Explicitly prohibit withdrawal permissions and recommend disabling trading permissions unless essential.
7. Store credentials in a protected secret-management facility, restrict configuration-file permissions, and avoid exposing secrets through command output or logs.
8. Establish dependency monitoring, reproducible builds, signed releases, and a documented process for reviewing package updates before deployment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to execute the package directly via npx without pinning a specific version, which means the latest published package is fetched and run at execution time. If the package is ever compromised, typosquatted, or a malicious update is published, users and agents could execute attacker-controlled code immediately.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README promotes querying wallet balances, portfolio data, and exchange account history through third-party providers and configured API keys, but it does not warn that wallet addresses, account metadata, and trading history may be transmitted to external services. In an AI-agent context, this is more dangerous because an agent may automatically process sensitive financial identifiers and account data without the user's informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description invites use for wallet balances, portfolio values, and Coinbase/Binance history without warning that these queries send wallet addresses and exchange-account-linked data to external providers. Users may disclose sensitive financial information and trading activity to third parties without informed consent, which is a privacy and operational security risk in a crypto context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The configuration section instructs users to store Coinbase and Binance API credentials, plus other service keys, in a local config file/environment context without any warning about secret handling. This increases the chance that high-value exchange credentials are stored insecurely, leaked through logs/backups, or exposed to other local processes, potentially enabling account data exposure or unauthorized API use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.