SPAWN Incubator

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:30 AM UTC
• Version: 1.0.1

Overview

This skill is coherent but should be reviewed carefully because it directs users to make irreversible cryptocurrency payments using dynamically supplied contract and fee details.

Before installing or using this skill, verify the Base chain ID, contract addresses, contract source or bytecode, fee amount, and transaction calldata through trusted sources outside the skill. Treat the entry fee as permanently at risk, and do not let an agent submit or sign any value-bearing transaction without showing you the exact destination, function call, and amount first.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:52

Finding

Unverified Dynamic Destination for Irreversible Cryptocurrency Payments

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:52-59, SKILL.md:85-89, SKILL.md:103, and SKILL.md:139
Vulnerability Type: Unverified external transaction parameters and smart-contract destination
Risk Level: High

Vulnerable Code

text

GET https://spawn.fund/api/fee

json

{
  "fee": "0.004",
  "feeWei": "4000000000000000"
}

text

Call `applyToIncubator(string ideaURI, string ideaHash)` on the SpawnIncubator contract with the entry fee attached.

- `ideaURI`: URL or IPFS hash pointing to your proposal JSON
- `ideaHash`: SHA-256 hash of the proposal content (for integrity verification)
- `msg.value`: At least the current entry fee (check via API)

text

- Your entry fee stays in the treasury (non-refundable)

text

Contract addresses are available via `GET /api/stats`.

Technical Analysis

The Skill directs an agent or user to obtain both the required payment amount and the smart-contract address from the same external service, spawn.fund. It does not pin a canonical contract address, require validation of deployed runtime bytecode, specify an expected code hash, or require confirmation through an independent trusted source.

Consequently, HTTPS is the only documented trust control. HTTPS protects transport under normal conditions but does not establish that the address returned by the service is the intended audited contract. Compromise of the domain, DNS, TLS termination infrastructure, hosting account, API service, or its administrative controls could allow an attacker to replace the returned fee and contract address.

The instruction to attach at least the API-provided fee further lacks a documented upper bound. A manipulated response could therefore specify an unexpectedly large payment. Because the entry fee is explicitly non-refundable and blockchain transfers are generally irreversible, incorrect transaction parameters can cause perman ...[truncated 1613 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the canonical Base chain ID and all expected production contract addresses directly in the reviewed Skill.
2. Publish expected deployed runtime bytecode hashes and require an exact on-chain bytecode comparison before any transaction is prepared.
3. Verify each address against an independent trusted source, such as a verified block-explorer entry or a separately maintained signed release manifest.
4. Cryptographically sign address and fee metadata, and verify the signature against a public key pinned in the Skill.
5. Define a strict maximum application fee. Abort if the API response is malformed, uses the wrong chain, exceeds the limit, or differs materially from independently retrieved data.
6. Simulate the transaction before submission and verify the chain ID, recipient, function selector, decoded arguments, transferred value, and expected state changes.
7. Require explicit human confirmation for every value-bearing transaction. The confirmation should display the full destination address, network, exact amount, and decoded contract call.
8. Document the contracts' verified source code, proxy or upgradeability status, owner and administrator privileges, and emergency controls.
9. Do not grant token allowances or broad wallet permissions unless they are strictly necessary, bounded, and separately reviewed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill instructs users to make a non-refundable on-chain payment to apply, but it does not present a prominent warning section that clearly explains the risk of irreversible loss, rejection without refund, contract risk, price volatility, and possible loss from interacting with Base L2. Because the workflow directly encourages a financial transaction, users may proceed without appreciating that funds can be permanently lost even if the application is rejected or if contract/backend details are inaccurate.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.