T08 · Insecure Dependencies
Warning
- Location
SKILL.md:27- Finding
Security-Sensitive SDK Installation Is Not Version-Pinned
- Content
View full analysis
- Remediation
View remediation
Security audit
Sdk
Security checks for vulnerabilities and agentic risk
Overview
This is a disclosed sports simulation SDK, but paid simulations can automatically spend USDC from a configured Solana wallet without a clear per-transaction confirmation step.
Review before installing. Use only a dedicated low-balance Solana wallet, avoid raw private keys for a primary wallet, pin the exact package version, and require the agent to confirm amount, recipient, network, and game parameters before every paid simulation.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
other
Error
- Location
src/services/simulation.ts:50- Finding
Simulation Requests Trigger Irreversible USDC Payments Without Explicit Per-Transaction Confirmation
- Content
View full analysis
{ if (!this.config.wallet) { throw new WalletNotConfiguredError(); } const publicKey = this.getPublicKey(); // Check balance first const balance = await this.checkBalance(); if (!balance.sufficient) { throw new InsufficientBalanceError(PRICE_USDC, balance.usdc); } try { // Get token accounts const senderAta = await getAssociatedTokenAddress(this.usdcMint, publicKey); const recipientAta = await getAssociatedTokenAddress(this.usdcMint, this.treasuryWallet); // Create transfer instruction const transferInstruction = createTransferInstruction( senderAta, recipientAta, publicKey, BigInt(PRICE_USDC_RAW), [], TOKEN_PROGRAM_ID ); // Build transaction const transaction = new Transaction().add(transferInstruction); const { blockhash, lastValidBlockHeight } = await this.connection.getLatestBlockhash(); transaction.recentBlockhash = blockhash; transaction.feePayer = pub ...[truncated 3884 chars]- Remediation
View remediation
Promise; ``` Abort unless it explicitly returns `true`. 4. Add per-transaction, per-session, and daily spending limits. Default to zero automatic spending for agent-driven environments. 5. Add idempotency keys and persist payment-to-request associations so retries reuse a valid payment proof instead of creating another transfer. 6. Validate the sport, game identifier, simulation availability, and request parameters before payment. 7. Define refund or payment-recovery behavior for API failures, rejected proofs, failed jobs, and polling timeouts. 8. Prefer wallet adapters that display transaction details for user approval. If raw `Keypair` support remains available, label it as unattended signing and require an explicit opt-in configuration flag. 9. Narrow the Skill trigger language so general requests for odds or analysis do not imply authorization to spend funds. The agent should first explain that the action costs 0.50 USDC and request confirmation. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (65)
Known Vulnerable Dependency: vitest==1.6.1 — 1 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed)
Critical
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
vitest 1.6.1 is flagged for arbitrary file read and execution when the Vitest UI server is listening. Although this is a dev dependency, the consequence is severe: if developers or CI run the vulnerable UI server in a reachable environment, an attacker may gain access to sensitive files or execute code.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill also retrieves daily picks and track records from external APIs, which differs from a pure simulation role. While less severe than wallet signing, capability mismatch still matters because it broadens data flows and user expectations beyond what the description advertises.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill also retrieves daily picks and track records from external APIs, which differs from a pure simulation role. While less severe than wallet signing, capability mismatch still matters because it broadens data flows and user expectations beyond what the description advertises.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill also retrieves daily picks and track records from external APIs, which differs from a pure simulation role. While less severe than wallet signing, capability mismatch still matters because it broadens data flows and user expectations beyond what the description advertises.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill also retrieves daily picks and track records from external APIs, which differs from a pure simulation role. While less severe than wallet signing, capability mismatch still matters because it broadens data flows and user expectations beyond what the description advertises.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill also retrieves daily picks and track records from external APIs, which differs from a pure simulation role. While less severe than wallet signing, capability mismatch still matters because it broadens data flows and user expectations beyond what the description advertises.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill also retrieves daily picks and track records from external APIs, which differs from a pure simulation role. While less severe than wallet signing, capability mismatch still matters because it broadens data flows and user expectations beyond what the description advertises.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill also retrieves daily picks and track records from external APIs, which differs from a pure simulation role. While less severe than wallet signing, capability mismatch still matters because it broadens data flows and user expectations beyond what the description advertises.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill also retrieves daily picks and track records from external APIs, which differs from a pure simulation role. While less severe than wallet signing, capability mismatch still matters because it broadens data flows and user expectations beyond what the description advertises.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill also retrieves daily picks and track records from external APIs, which differs from a pure simulation role. While less severe than wallet signing, capability mismatch still matters because it broadens data flows and user expectations beyond what the description advertises.
- Content
Known Vulnerable Dependency: bigint-buffer==1.1.5 — 1 advisory(ies): CVE-2025-3194 (bigint-buffer Vulnerable to Buffer Overflow via toBigIntLE() Function)
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
bigint-buffer 1.1.5 is flagged for a buffer overflow issue in toBigIntLE(). Even though it is a transitive dependency, memory-safety flaws in parsing/serialization code can become dangerous when attacker-controlled binary data reaches affected paths, especially in blockchain-related libraries that process structured binary inputs.
- Content
Known Vulnerable Dependency: nanoid==3.3.11 — 3 advisory(ies): CVE-2026-67214 (nanoid: non-secure generators can loop indefinitely with negative size); CVE-2026-67213 (nanoid: custom generators can loop indefinitely when size is zero); CVE-2026-73086 (nanoid: Integer Overflow or Wraparound)
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
- Content
Known Vulnerable Dependency: postcss==8.5.8 — 4 advisory(ies): CVE-2026-45623 (PostCSS: Arbitrary file read and information disclosure via attacker-controlled ); CVE-2026-69153 (PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappi); CVE-2026-41305 (PostCSS has XSS via Unescaped </style> in its CSS Stringify Output) +1 more
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
postcss 8.5.8 has multiple advisories including arbitrary file-read and XSS-related issues. In this package-lock it is a dev/build dependency, which reduces exposure, but exploitation could still matter in CI, local development, or any workflow that processes attacker-influenced CSS or source map inputs.
- Content
Known Vulnerable Dependency: ws==8.20.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)
High
- Category
- Supply Chain
- Confidence
- 86% confidence
- Finding
ws 8.20.0 is associated with memory disclosure and memory exhaustion issues. Because this package supports Solana/websocket-based communication through rpc-websockets, the dependency is more relevant than a dormant dev-only package, and malformed remote websocket traffic could potentially affect confidentiality or availability.
- Content
Known Vulnerable Dependency: vite==5.4.21 — 3 advisory(ies): CVE-2026-39365 (Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling); CVE-2026-53571 (vite: `server.fs.deny` bypass on Windows alternate paths); CVE-2026-53632 (launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows)
High
- Category
- Supply Chain
- Confidence
- 82% confidence
- Finding
vite 5.4.21 has several advisories involving path traversal, deny-list bypass on Windows, and hash disclosure behavior. Since vite is a dev dependency, exploitation is mainly relevant during local development or CI, but can still expose files or credentials if a vulnerable dev server is run in an unsafe environment.
- Content
Known Vulnerable Dependency: ws==7.5.10 — 1 advisory(ies): CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)
High
- Category
- Supply Chain
- Confidence
- 84% confidence
- Finding
ws 7.5.10 has a memory exhaustion DoS issue. This older websocket library appears in the jayson branch, and if reachable through network-facing RPC/websocket operations, an attacker could potentially degrade availability through crafted fragmentation patterns.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This file implements real payment processing, including wallet handling, balance checks, and USDC transfers to a treasury wallet, which materially exceeds a sports betting simulation/analysis capability. In an agent-skill context, hidden or weakly justified payment code creates a strong risk of unauthorized fund movement or deceptive monetization, especially when users may not expect on-chain transfers from a simulation tool.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill has direct capability to sign and send Solana USDC transfers using either a Keypair or wallet adapter, sending funds to a hard-coded treasury wallet. For a skill described as Monte Carlo sports betting simulation, this capability is not justified by the stated purpose and is dangerous because it enables monetary loss if invoked unexpectedly, abused by surrounding code, or insufficiently disclosed to the user.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README instructs users to load a Solana wallet secret key directly from a local file, but provides no warning about the sensitivity of that material or safer handling practices. In the context of a package that initiates paid blockchain transactions, normalized copy-paste handling of raw private keys increases the chance of wallet compromise, accidental exposure in logs, repos, screenshots, or agent environments.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill declares network-dependent behavior, wallet handling, and paid API interactions but does not declare any explicit tool scope or allowed-tools. This creates a transparency and governance gap: an agent could invoke networked or payment-capable behavior without clear sandboxing or user-visible permission boundaries.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill advertises simulation actions without a prominent warning that they trigger a $0.50 USDC on-chain payment using a configured Solana wallet. In a conversational agent setting, insufficient cost and transaction disclosure can lead to unauthorized spending, especially when users think they are requesting simple analysis.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Broad trigger phrases such as 'What should I bet on today?' can capture ordinary user requests and route them into a skill that has associated payment and gambling-related workflows. In context, this is more dangerous because the skill also supports paid simulations and wallet-based transactions, increasing the chance of accidental invocation or escalation.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 87% confidence
- Finding
The skill transmits user-driven requests to an external API endpoint, which is expected for this service but still constitutes external data exposure. In context, risk is elevated because requests may be associated with wallet-linked activity, betting interests, and potentially payment workflow metadata.
- Content
md ## Links - Website: https://edgebets.fun - API Docs: https://api.edgebets.fun/api/v1/x402 - OpenAPI Spec: https://api.edgebets.fun/api/v1/x402/openapi.json - npm Package: https://www.npmjs.com/package/edgebets-sdk
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 83% confidence
- Finding
The OpenAPI spec endpoint indicates additional external retrieval from a third-party domain, which expands the attack surface and may expose metadata about the skill's operation. While not inherently malicious, undisclosed or unnecessary external fetches can leak usage patterns and increase trust dependence on a remote service.
- Content
md - Website: https://edgebets.fun - API Docs: https://api.edgebets.fun/api/v1/x402 - OpenAPI Spec: https://api.edgebets.fun/api/v1/x402/openapi.json - npm Package: https://www.npmjs.com/package/edgebets-sdk
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest frames the skill as providing AI-powered sports betting simulations with Monte Carlo analysis. However, the declarations show the skill requires a Solana wallet adapter or keypair and supports signing blockchain transactions, which is a materially broader behavior than simulation/analysis alone.
- Content
Static analysis
No suspicious patterns detected.