check-hymx-info

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:48 AM UTC
• Version: 1.0.3

Overview

The skill has a coherent purpose, but its bundled script lets a remote Hymatrix API response choose additional network request destinations without validation.

Review this skill before installing in environments that can reach internal services or cloud metadata endpoints. It appears intended to fetch Hymatrix bridge token information, but it should restrict follow-up network requests to trusted Hymatrix hosts and disclose its network behavior more clearly.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: script/index.js:53

Finding

Unvalidated Remote-Controlled Bridge URL Enables Server-Side Request Forgery

Content

View full analysis

Vulnerability Details

File Location: script/index.js, lines 53–55 and 61–69
Vulnerability Type: Server-Side Request Forgery (SSRF) through an unvalidated remote-supplied URL
Risk Level: Medium

Vulnerable Code

js

export const getHymxCacheTokenInfo = async (nodeUrl, pid, key) => {
  const url = `${nodeUrl}/cache/${pid}/${key}`
  const result = fetchAOXInfo(url)
  return result
}

The remotely supplied value is passed into this function as follows:

js

const hymatrixBridgeInfo = await fetchAOXInfo(`${ENDPOINTS.AOX}`)
const cachesTokenInfo = await Promise.all(
  hymatrixBridgeInfo.tokenInfo.map(async (item) => {
    const tokenInfo = await getHymxCacheTokenInfo(
      hymatrixBridgeInfo.bridgeNodeUrl,
      item.wrappedTokenId,
      'info'
    )

Technical Analysis

The Skill legitimately requires outbound network access to retrieve current Hymatrix bridge information. However, its initial fixed development endpoint controls hymatrixBridgeInfo.bridgeNodeUrl, which is then used as the base URL for additional fetch requests without validating its protocol, hostname, port, resolved IP address, or redirect behavior.

The same remote response also controls item.wrappedTokenId, which is directly interpolated into the request path. Consequently, compromise of the fixed API or its response path could cause the process to send HTTP requests to attacker-selected destinations, including loopback, link-local, or private-network services accessible from the host.

This exceeds the minimum network privileges needed for the declared functionality. The Skill only needs to contact known Hymatrix infrastructure, but the implementation effectively delegates destination selection to an untrusted remote response.

The finding does not establish that credentials, local files, environment variables, or stdin content are currently transmitted. It identifies an exploitable network-request primitive rather than confirmed sensitive-data exfiltr ...[truncated 1616 chars]

Remediation

View remediation

Remediation Suggestions

1. Allowlist bridge destinations

   • Accept only explicitly approved Hymatrix hostnames.
   • Require the https: protocol.
   • Reject embedded credentials, unexpected ports, and malformed URLs.

2. Block internal destinations

   • Resolve the hostname before connecting.
   • Reject loopback, private, link-local, multicast, unspecified, and reserved IPv4/IPv6 ranges.
   • Account for DNS rebinding by validating the address actually used for each connection.

3. Control redirects

   • Disable redirects where possible, or validate the protocol, hostname, port, and resolved address of every redirect target.

4. Validate path components

   • Enforce a strict character and length allowlist for wrappedTokenId.
   • Encode path segments with encodeURIComponent rather than directly interpolating remote values.

5. Use a fixed trusted base URL

   • If dynamic bridge-node discovery is unnecessary, configure the bridge-node origin locally instead of accepting it from an API response.

6. Apply network-level restrictions

   • Restrict the Skill's outbound access to approved Hymatrix endpoints through firewall, proxy, or sandbox policy.
   • Deny access to cloud metadata and internal management networks.

7. Harden response processing

   • Validate remote JSON against a strict schema before using any fields.
   • Impose response-size and request-time limits.
   • Limit concurrency to reduce the potential for internal scanning or resource exhaustion.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md

command: node script/index.js

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The Trigger section says "When asking users for cross-chain information, which tokens are supported?", which reads like a broad conversational condition rather than a specific invocation phrase or bounded context. It does not define clear trigger phrases, scope limits, or negative examples, so the skill could be invoked for ordinary discussion about tokens or cross-chain topics.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This code fetches data from external endpoints via fetch(url) and later uses bridge URLs returned from the first response to make additional network calls. There is no confirmation prompt, user-facing log/print, or comment/docstring disclosing that the skill transmits data over the network.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.