Security audit

ETHSkills

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed Ethereum documentation helper, but it asks agents to trust mutable remote skill instructions and run an unpinned package installer.

Review fetched ethskills.com documents before letting an agent act on them, do not allow remote guidance to override user intent or safety rules, and only run create-eth in a disposable workspace after pinning or verifying the package version and protecting wallets, secrets, and environment variables.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Warning

Location: SKILL.md:32
Finding: Mutable Remote Skill Instructions Cross the Local Audit Boundary
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:85
Finding: Unpinned Third-Party Package Is Downloaded and Executed Through npx
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README states that the skill should be used whenever an agent encounters any Ethereum, Solidity, or dApp task, which is a very broad activation scope. Overly broad triggering can cause the agent to over-rely on remote, untrusted documentation for a wide range of tasks, increasing prompt-injection and supply-chain exposure whenever the skill is invoked.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The activation criteria are very broad, covering nearly any web3/blockchain/onchain development task, including common requests about wallets, tokens, gas, and smart contracts. Broad routing increases the chance this skill is invoked in ambiguous situations and then influences downstream behavior with external-fetch instructions and operational guidance, expanding attack surface and the likelihood of unsafe tool use.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill instructs agents to run npx create-eth@latest, which fetches and executes remote package code without pinning to a specific reviewed version. In an agent context, this creates a supply-chain execution risk: a compromised publisher account, malicious release, or dependency hijack could lead to arbitrary code execution on the host.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The example workflow explicitly tells the agent to run npx create-eth@latest, again causing execution of unpinned remote code. Because this appears in a procedural workflow, it is especially likely to be followed automatically by an agent, increasing the chance of real exploitation through a malicious or altered upstream package.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.