T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:38- Finding
Automatic External Disclosure of Complete User-Provided URLs
- Content
View full analysis
- Remediation
View remediation
Security audit
Antalpha Airdrop Hunter
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly coherent as an airdrop assistant, but it needs Review because it auto-checks any pasted URL through an external MCP tool and includes multi-account/sybil-evasion guidance.
Install only if you are comfortable with an external MCP service checking airdrop URLs. Do not paste signed links, password-reset links, private documents, invite URLs, internal hostnames, or URLs containing tokens/query secrets. Treat its airdrop strategy as informational, avoid multi-account or sybil-evasion tactics, and independently verify official project links before connecting a wallet.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/date_filter.py:15- Finding
Date Filter Fails Open for Malformed and Future Timestamps
- Content
View full analysis
bool: """ Check if a date string is within the last `max_days` days. Args: date_str: ISO 8601 date string (e.g., "2026-04-13T10:30:00Z") max_days: Maximum age in days Returns: True if the date is within the window, False otherwise """ try: # Parse ISO 8601 date article_date = datetime.fromisoformat(date_str.replace("Z", "+00:00")) now = datetime.now(timezone.utc) age = now - article_date return age.days <= max_days except (ValueError, TypeError): # If date cannot be parsed, include the article by default # (better to show stale info than miss opportunities) return True ``` ### Technical Analysis The filter includes records when their timestamps cannot be parsed. This is a fail-open validation policy: malformed or missing dates are treated as sufficiently recent rather than rejected or quarantined. Future timestamps also bypass the age restriction. For a future timestamp, `now - article_date` is negative, making `age.days <= max_days` true for ordinary nonnegative values of `max_days`. Although future dates are intentionally allowed elsewhere in the script, this function does not distinguish publication dates from future event deadlines. An attacker or unreliable data source can therefore bypass the freshness filter using either: - An invalid timestamp, causing the exception handler to return `True`. - A far-future timestamp, causing a negative age to satisfy the comparison. This behavior conflicts with the Skill's security-sensitive self-reflection requirement to ensure information is from the preceding 24–48 hours. Airdrop and phishing information becomes stale qu ...[truncated 1771 chars]- Remediation
View remediation
now + timedelta(minutes=5): return False ``` 5. Store scheduled snapshots, claim windows, and deadlines in separate fields rather than treating them as publication dates. 6. Validate `max_days` and reject negative values. 7. Validate the JSON schema before filtering: - The root value must be a list. - Every item must be an object. - Every item must contain a valid publication timestamp. 8. Compare total elapsed time rather than only `timedelta.days`: ```python return timedelta(0) <= age <= timedelta(days=max_days) ``` 9. Add tests covering malformed dates, missing dates, timezone-naive dates, far-future dates, boundary timestamps, and negative `max_days`. 10. Mark records that cannot be independently verified as untrusted and exclude them from actionable recommendations. ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)
Anti-Refusal Statement
High
- Category
- Anti-Refusal
- Confidence
- 80% confidence
- Finding
Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
- Content
md No warnings detected. You can proceed with caution.
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The manifest promises scam checking, grading, and guided verification, but the analyzed behavior reportedly performs unrelated local file I/O and JSON date filtering instead. This mismatch is dangerous because users and the platform may trust the skill with security-sensitive workflows while hidden or undocumented behavior executes under a misleading description.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The quick-command phrases are generic natural-language utterances like "daily report," "check [project]," and "any zero-cost?" that are likely to appear in ordinary user conversation. In an agent environment, broad triggers can cause accidental activation of this skill in contexts the user did not intend, leading to misrouting, confused tool use, or unintended security-sensitive guidance around wallet interactions and URLs.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill declares no explicit tool scope or permissions, yet the analysis detected file_read/file_write capabilities. Undeclared capabilities weaken least-privilege guarantees and can let the skill access or modify local data outside the user's expectations if those capabilities are actually reachable.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The manifest description itself defines broad auto-trigger conditions like checking projects, verifying links, or finding opportunities, which can overlap with many ordinary user requests. Overbroad triggers expand the skill's activation surface and may cause unsolicited handling of links or project names in unrelated conversations.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad enough to match common conversational text such as help/start/how to begin, increasing the chance this skill activates unintentionally. In a security-sensitive Web3 context, accidental activation can steer users into automated workflows or tool calls they did not explicitly request.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
The skill mandates automatic tool execution based on heuristics such as the presence of a URL or a standalone project name, without requiring explicit user confirmation. Autonomous execution is risky because it can process attacker-supplied inputs, trigger external lookups, or influence user decisions in a phishing-prone Web3 setting.
- Content
md ## 2. Automation Triggers (MANDATORY) | User Input Pattern | Auto-Execute Tool | Reason | |--------------------|-------------------|--------| | User provides a URL (with or without context) | `airdrop-scam-check` | Safety first. Verify before they click. | | User provides only a Project Name (no verb/intent) | `airdrop-check-project` | They want to know if it's worth their time. |
Behavior Manipulation
Medium
- Category
- Prompt Injection
- Confidence
- 75% confidence
- Finding
Subtle instructions detected that may alter agent decision-making or introduce hidden biases.
- Content
md ## Prohibited Tokens (Hard Block) These projects have already completed their airdrops. **NEVER recommend them** as active opportunities: | Project | Token | Status | |---------|-------|--------|
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Multiple example output fields and rendered content are written in Chinese, including summary, advice, and commentary text, and the file states this template defines output for all reports. Because the template does not offer a language choice or explain that the skill is intentionally region-specific, it creates a natural-language locale policy concern.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The project-analysis and zero-cost output examples include Chinese text for assessment fields, verdict phrasing, and survival tips, reinforcing a single-language output policy across the skill. This appears to mandate a locale rather than offering it as an option.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The template explicitly offers a 'Check Multi-Account Strategy' flow and sybil-evasion style guidance in an airdrop-hunting skill. That goes beyond benign project discovery or scam checking and can facilitate abuse of anti-sybil controls, platform gaming, or policy-violating account farming. In this skill context, that makes the behavior more dangerous because users are being operationally guided toward evasion-oriented actions, not merely informed about risks.
- Content