Security audit
Security checks for vulnerabilities and agentic risk
This skill is coherent for blockchain transaction analysis, but it can save remotely fetched contract source to any local path, so it should be reviewed before installing.
Install only if you are comfortable with a skill that executes a local Python script, calls skylens.certik.com, and can write fetched source code to a user-specified path. Avoid using --OUTPUT unless you choose a safe destination inside your workspace, and review any saved files before letting other tools execute or trust them.
The declared description says the skill inspects transactions via trace, balance, state, and nonce analysis, but the documented commands also enumerate and fetch contract source files and optionally write them to disk. This mismatch can mislead users and policy engines about the real behavior, causing the skill to be approved or invoked under a narrower trust model than its actual capabilities warrant.
The get-source-file path not only retrieves contract source but also accepts an --OUTPUT path and writes arbitrary retrieved content to the local filesystem. In an agent setting, this exceeds a read-only analysis skill and creates a write primitive that can modify the host workspace, overwrite files, or plant attacker-controlled content if the transaction/address parameters are influenced by untrusted input.
The code performs Path(output).expanduser(), creates parent directories, and writes content without validating destination or limiting where writes may occur. That gives the skill an unnecessary local file write capability for its stated purpose, enabling arbitrary file creation/overwrite within the executing user's permissions and making chaining attacks against other tools or repositories more plausible.
The README advertises source-code retrieval features (list-source-files, get-source-file) that go beyond the stated transaction-analysis scope in the skill metadata. This kind of scope expansion is dangerous because agents and reviewers may rely on the declared capability boundary, while the documented commands enable additional data access and inspection behavior that was not transparently declared.
The recommended workflow instructs the agent to pivot from transaction inspection into contract source-code inspection, which broadens the operational scope beyond the declared tx-level investigation purpose. In an agent setting, undocumented investigative expansion can lead to unnecessary data retrieval, policy bypass, or use of capabilities that users and orchestrators did not authorize.
Including source-file commands in the command table reinforces an undocumented capability that is inconsistent with the stated skill scope. This mismatch increases the chance that downstream agents invoke higher-privilege or broader-analysis actions under the assumption they are approved parts of the skill.
The skill declares executable behavior requiring outbound network access and file writing, but it does not explicitly scope or constrain those capabilities through permissions or allowed-tools metadata. This increases the chance that an agent runtime grants broader-than-expected privileges, making unintended file writes or remote data access easier if the skill is invoked in a sensitive environment.
The skill exposes source-code retrieval functionality (_get_skylens_source_code_all) that goes beyond the declared transaction-analysis scope of trace, balance, storage, and nonce inspection. Scope expansion is dangerous because downstream agents or users may rely on the manifest to constrain capability, but this script can additionally pull contract source artifacts and later feed them into other workflows, increasing data exposure and tool misuse risk.
This markdown file describes get-source-file with an --OUTPUT option that writes content to disk, but it does not include any warning about modifying the local filesystem or potential overwrite/placement risks. Under the markdown-specific warning criteria, file-affecting behavior should be disclosed when it could affect user data or system integrity.
The markdown documents an option to save fetched content to a user-specified path but provides no warning about file-write behavior or any path restrictions. In agent environments, this can enable unsafe writes to unintended locations, especially if user input is passed through directly to the output path.
The get-source-file path can write retrieved content to an arbitrary local path via --OUTPUT, creating parent directories and overwriting file contents. Although the code reports completion after writing, there is no confirmation prompt, pre-write warning, or explanatory comment/docstring near the operation to disclose that local filesystem changes will occur.
No suspicious patterns detected.
