ChainAware Behavioral Prediction

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:50 PM UTC
• Version: 1.0.7

Overview

This skill is a disclosed connector to ChainAware's remote blockchain-risk service, with the main caveat that some web integrations put the service API key in the URL.

Install this only if you are comfortable sending blockchain addresses, contract addresses, network identifiers, and your ChainAware credential to ChainAware for remote scoring. Prefer integrations that pass the API key in a header, use restricted-scope or low-limit keys for web URL setups, rotate keys if exposed, and set payment or quota limits before relying on x402 pay-per-call behavior.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:553

Finding

API Key Exposure Through URL Query Parameters

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 553, 579, and 743
Vulnerability Type: API credential exposure through URL query strings
Risk Level: Medium

Vulnerable Code Snippets

At line 553:

markdown

3. URL: `https://prediction.mcp.chainaware.ai/sse?apiKey=your-key-here`

At line 579:

markdown

3. URL: `https://prediction.mcp.chainaware.ai/sse?apiKey=your-key-here`

At line 743:

markdown

- **Claude Web / ChatGPT**: key must be appended to the SSE URL (`?apiKey=...`) — these platforms do not support custom SSE headers. Be aware the key will appear in your browser's network tab. Use a restricted-scope key for these integrations.

Technical Analysis

The integration instructions recommend placing CHAINAWARE_API_KEY in an SSE endpoint's query string. Although HTTPS protects the URL while it is in transit, it does not prevent the complete URL from being retained or exposed at endpoints and intermediaries.

Query strings may appear in browser history, client diagnostics, application telemetry, reverse-proxy or server access logs, monitoring systems, support bundles, screenshots, and copied configuration. The Skill acknowledges exposure in the browser's network interface but continues to prescribe query-string authentication.

This credential transmission is not required for integrations that support authentication headers. For clients that cannot provide secure headers, a long-lived API key in the URL remains unsafe and exceeds minimum safe credential-handling privileges.

Attack Path

1. A user follows the Claude Web, ChatGPT, or similar integration instructions.
2. The user substitutes a valid API key into the apiKey query parameter.
3. The complete endpoint URL is recorded or displayed in browser diagnostics, client configuration, telemetry, logs, screenshots, or support data.
4. An attacker or unauthorized operator obtains access to one of those records.
5. The attacker extracts the API key from the ...[truncated 1072 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove examples that place long-lived API keys in query strings.
2. Prefer an Authorization or X-API-Key header for every supported integration.
3. Use a platform-provided encrypted secret or credential field where available.
4. If a client cannot securely set authentication headers, recommend a trusted local or organizational proxy that injects the credential server-side.
5. If URL authentication is unavoidable, issue short-lived, single-purpose tokens rather than account API keys.
6. Apply narrow scopes, strict rate and spending limits, short expiration periods, and origin or client restrictions to such tokens.
7. Warn users that URLs may be retained beyond the browser network tab, including in history, logs, telemetry, diagnostics, and copied configurations.
8. Provide a documented revocation and rotation procedure and advise immediate rotation following suspected disclosure.
9. Redact apiKey query parameters in server, proxy, application, and observability logs.
10. Ensure automatic x402 payment handling requires explicit user authorization and enforce spending limits so credential-free fallback cannot create unexpected charges.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 376)May include surrounding context.

md

**Key output fields:**
- `job_id` — unique job identifier (store this)
- `signature` — access token for follow-up calls (store this)
- `status` — always `"pending"` on schedule response
- `total_items` — number of wallets submitted

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 398)May include surrounding context.

md

**Key output fields:**
- `job_id` — unique job identifier (store this)
- `signature` — access token for follow-up calls (store this)
- `status` — always `"pending"` on schedule response
- `total_items` — number of wallets submitted

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger description is so broad that it can cause this skill to activate for many generic wallet, token, contract, compliance, ranking, and agent-trust requests, increasing the chance of overcollection and unnecessary transmission of user-supplied blockchain identifiers to a third-party SSE endpoint. In an agent environment, overbroad routing can also suppress safer or more appropriate tools, causing security and privacy decisions to rely on one remote service too often.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

At L116 the documentation explicitly tells operators not to use this skill for smart contract code analysis, implying that capability is out of scope. However, L066-L069 and L137-L138 describe token audit features, and L690 further markets a subagent for deep contract audit via this same MCP ecosystem, creating a direct contradiction in documented intent.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:13