Ethereum Read Only

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:47 AM UTC
• Version: 1.0.0

Overview

This read-only Ethereum guide mostly matches its stated purpose, but it needs Review because it asks users to run an unverified remote installer and includes a shell example that can execute injected commands.

Review before installing. Only run the Foundry installer if you trust the upstream source, prefer a pinned and verified installation method, avoid copying the eval-based function as written, and be aware that the ABI and ENS examples can disclose queried selectors, events, names, or profile fields to RPC providers and 4byte.directory.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:17

Finding

Unverified Remote Installer Is Downloaded and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 17–18
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash

curl -L https://foundry.paradigm.xyz | bash
foundryup

Technical Analysis

The setup instructions stream a mutable response from an external URL directly into Bash. The remote script is executed without being saved for review, pinned to a specific version, or validated using a cryptographic signature or checksum. The -L option also follows redirects, expanding the set of infrastructure that must remain trustworthy.

The subsequent foundryup command installs or updates executable Foundry components and may retrieve additional mutable artifacts. Installing cast supports the Skill's declared Ethereum read-only functionality, but immediate execution of an unverified remote script exceeds the minimum security exposure necessary to install that tool.

This instruction is not proof that the current upstream installer is malicious. Nevertheless, it establishes a remote code-execution channel whose effective payload can change after the Skill has been reviewed.

Attack Path

1. An attacker compromises the distribution domain, redirect destination, hosting infrastructure, or release pipeline.
2. The attacker causes the URL to return a modified shell script.
3. A user follows the documented setup command.
4. curl retrieves the attacker-controlled content and passes it directly to Bash.
5. Bash executes the payload immediately with the privileges of the invoking user.
6. The payload can modify user files, access user-readable credentials, install altered executables, or establish additional compromise.

Impact Assessment

Successful exploitation permits arbitrary command execution under the invoking user's account. This can expose RPC credentials and other user-readable secrets, alter shell configuration, replace development tools, modify project files, and compromise fu ...[truncated 215 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin installation to a specific Foundry release rather than using an automatically changing installer or updater.
2. Download the release artifact without executing it immediately.
3. Verify its publisher-provided cryptographic signature or checksum over a trusted channel.
4. Abort installation if verification fails.
5. Inspect or explicitly approve the downloaded installer before execution.
6. Avoid curl | bash and document that installation must run as an unprivileged user.
7. Record the expected version and integrity value in the Skill documentation.
8. If package-manager installation is available from a trusted repository, prefer a version-pinned package with repository signature validation.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:247

Finding

Shell Command Injection Through Dynamically Constructed eval Command

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 247–272
Vulnerability Type: Shell command injection
Risk Level: High

Vulnerable Code

bash

# 基本検索コマンド構築
local cmd="cast logs --rpc-url $ETH_RPC_URL"
cmd="$cmd --address $contract_address"
cmd="$cmd --from-block $from_block"
cmd="$cmd --to-block $to_block"
cmd="$cmd $transfer_sig"

# フィルター追加
if [[ -n "$sender" ]]; then
    cmd="$cmd $sender"
fi

if [[ -n "$receiver" ]]; then
    if [[ -z "$sender" ]]; then
        cmd="$cmd '' $receiver"  # sender未指定の場合は空文字
    else
        cmd="$cmd $receiver"
    fi
fi

echo "実行コマンド: $cmd"

# ログ実行と結果パース
eval "$cmd" | jq -r '.[] | "ブロック: \(.blockNumber), TX: \(.transactionHash), ログインデックス: \(.logIndex)"'

Technical Analysis

The function constructs a shell command by concatenating ETH_RPC_URL and function arguments into a string, then reparses that string using eval. The values are neither safely shell-quoted nor validated against strict formats.

Consequently, shell metacharacters, command substitutions, redirections, and command separators embedded in an RPC URL, contract address, block identifier, sender, or receiver are interpreted as shell syntax rather than as literal cast arguments. Quoting "$cmd" at the eval call does not prevent injection because eval deliberately parses the resulting string as a new shell command.

The declared functionality only requires invoking cast logs with arguments. It does not require dynamic shell evaluation, making the use of eval unnecessary.

Attack Path

1. An attacker influences an argument passed to search_transfer_events or the ETH_RPC_URL environment variable.
2. The attacker includes shell syntax in that value, such as a command separator followed by another command.
3. The function concatenates the value into cmd.
4. eval "$cmd" reparses the entire string as shell source.
5. The injected shell command executes under the account running the example script.
6. Output may st ...[truncated 540 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove eval entirely.
2. Build the command as a Bash array so each value remains one literal argument:

bash

local cmd=(
    cast logs
    --rpc-url "$ETH_RPC_URL"
    --address "$contract_address"
    --from-block "$from_block"
    --to-block "$to_block"
    "$transfer_sig"
)

if [[ -n "$sender" ]]; then
    cmd+=("$sender")
fi

if [[ -n "$receiver" ]]; then
    if [[ -z "$sender" ]]; then
        cmd+=("" "$receiver")
    else
        cmd+=("$receiver")
    fi
fi

printf 'Executing:'
printf ' %q' "${cmd[@]}"
printf '\n'

"${cmd[@]}" |
    jq -r '.[] | "Block: \(.blockNumber), TX: \(.transactionHash), log index: \(.logIndex)"'

3. Validate Ethereum addresses using a strict hexadecimal-address pattern before execution.
4. Restrict block identifiers to expected numeric values or an explicit allowlist such as latest, safe, and finalized.
5. Validate the RPC URL scheme and hostname according to deployment policy.
6. Treat environment variables as untrusted input and never interpolate them into shell source.
7. Add regression tests containing semicolons, command substitutions, spaces, quotes, and redirection characters to confirm they cannot trigger shell interpretation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The installation instruction pipes a remote script directly into bash, causing immediate execution of unverified code fetched over the network. This is a classic supply-chain and remote code execution risk because any compromise of the source, transport, or user environment results in arbitrary command execution on the host.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

bash

# Foundryインストール
curl -L https://foundry.paradigm.xyz | bash
foundryup

# 動作確認

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The use of a shell pipeline into bash obscures the downloaded content and encourages users to execute chained remote input without validation. In security terms, this reduces opportunities for inspection and compounds the risk of malicious or tampered installer content executing immediately.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

bash

# Foundryインストール
curl -L https://foundry.paradigm.xyz | bash
foundryup

# 動作確認

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The ENS text-record enumeration retrieves potentially sensitive profile metadata such as email, URL, social handles, and description without warning about privacy implications. Even though the data is public, presenting bulk collection as routine can encourage unnecessary profiling or accidental exposure in shared terminals and logs.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The ABI decoding examples send transaction selectors and event signatures to 4byte.directory via curl, introducing extra outbound network behavior not necessary for basic on-chain read-only access. This leaks user query context to a third party and expands the skill's effective trust boundary beyond the blockchain RPC endpoint described in the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The external 4byte.directory lookups are described without warning that transaction-derived data is sent to a third-party service. Users may assume all activity remains limited to their configured RPC provider, so the undocumented disclosure creates a privacy and supply-chain trust issue.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This read-only skill ends by directing users to obtain transaction-capable wallet/CLI guidance from an external trading site, which exceeds the declared scope and can nudge users into higher-risk actions. In a skill explicitly marketed as wallet-free and read-only, scope expansion is dangerous because it weakens trust boundaries and may funnel users toward unreviewed transaction workflows.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

ファイル全体の説明と利用手順が日本語のみで提供されており、ユーザーに言語選択肢や日本語前提である旨の明示がありません。ルール上、特定言語への固定は、ユーザーの選択または正当化された地域制約がない場合は方針違反となりえます。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.