Gougoubi Submit Real Results

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:23 AM UTC
• Version: 1.0.2

Overview

This skill is purpose-built for blockchain result submission, but it under-discloses irreversible transaction risk and points agents at unbundled relative scripts for high-impact actions.

Review carefully before installing. Only use it in a controlled repository where the referenced scripts are known, reviewed, and pinned, and require a manual confirmation of chain, signer, proposal, condition results, calldata, fees, and dry-run output before any real submission.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T07 · Tool Hijacking and Spoofing

Error

• Location: SKILL.md:91
• Finding: Unbundled Relative Script Entry Points Can Execute Unverified Local Code<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md:91-108` - `INSTALL.md:21-29` - `README.md:18-26` **Vulnerability Type**: Unverified relative script execution **Risk Level**: High ### Vulnerable Code `SKILL.md:91-108`: ```markdown ## Project Scripts - `scripts/pbft-submit-all-condition-results.mjs` - `scripts/pbft-submit-results-from-skills-once.mjs` - `scripts/pbft-submit-real-results-1605.mjs` - `scripts/pbft-submit-real-results-c427-confirmed.mjs` - `scripts/pbft-submit-real-results-ba0c-resolved-only.mjs` - `scripts/pbft-submit-remaining-no-ba0c.mjs` ## Script Entry Points - Generic fixed-side submission: `scripts/pbft-submit-all-condition-results.mjs` - Generic skills-derived submission: `scripts/pbft-submit-results-from-skills-once.mjs` - `node scripts/pbft-submit-all-condition-results.mjs --help` - `node scripts/pbft-submit-all-condition-results.mjs <proposalAddress> --result yes --dry-run` - `node scripts/pbft-submit-results-from-skills-once.mjs --help` - `node scripts/pbft-submit-results-from-skills-once.mjs <proposalAddress>` - Specialized scripts also support `--help` for their fixed proposal mappings. ``` `INSTALL.md:21-29`: ```markdown ## Post-install check If the local project scripts are available, verify the public entrypoints first: ```bash node scripts/pbft-submit-results-from-skills-once.mjs --help node scripts/pbft-submit-all-condition-results.mjs --help node scripts/pbft-submit-all-condition-results.mjs <proposalAddress> --result yes --dry-run ``` Restart the agent runtime after installation. ``` `README.md:18-26`: ```markdown Script entry: - `scripts/pbft-submit-results-from-skills-once.mjs` - `scripts/pbft-submit-all-condition-results.mjs` - `node scripts/pbft-submit-results-from-skills-once.mjs --help` - `node scripts/pbft-submit-results-from-skills-once.mjs <proposalAddress>` - `node scripts/pbft-submit-all-condition-results.mjs <proposalAddress> --result yes --dry-run` ``` ### Technical Analysis The aud ...[truncated 3027 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. **Bundle all required scripts** - Include every supported script in the published skill package. - Remove references to specialized scripts that are not distributed and reviewed. 2. **Resolve scripts from a trusted installation directory** - Determine the canonical skill directory at runtime. - Invoke scripts using a canonical absolute path under that directory. - Do not resolve transaction entry points against an arbitrary current working directory. 3. **Verify integrity before execution** - Publish cryptographic hashes or signed manifests for executable files. - Verify script integrity immediately before execution. - Abort when a script is missing, replaced, symlinked outside the trusted directory, or fails verification. 4. **Pin external source material** - If scripts must come from the referenced repository, pin an immutable commit identifier rather than a mutable branch. - Verify the downloaded artifact against a trusted digest or signature. - Do not automatically execute newly downloaded code. 5. **Apply transaction-specific safeguards** - Validate the chain ID and require an explicit contract allowlist. - Validate proposal and condition addresses using the expected address format. - Display the signer, chain, destination contract, result mapping, calldata, and expected fees before signing. - Require explicit user confirmation before broadcasting any non-dry-run transaction. - Preserve evidence, generated calldata, and transaction hashes in an audit log. 6. **Use least privilege** - Run evidence collection without access to signing keys. - Isolate transaction signing in a narrowly scoped component. - Avoid exposing seed phrases or raw private keys to the Node.js process. - Restrict filesystem and network access to what is necessary for the operation. 7. **Fail closed** - Do not fall back to similarly named local scripts. - If the verified implementa ...[truncated 137 chars]

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly performs on-chain result submissions, yet it does not clearly warn users that invoking it may create irreversible blockchain transactions with settlement consequences. In a blockchain governance/settlement context, insufficient disclosure can lead to accidental execution, unintended votes, and irreversible state changes if the agent proceeds without an explicit high-friction confirmation step.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The description is broadly scoped ('Use when users want ... outcomes submitted ... with resolved-only, all, and force modes') and does not define narrow activation conditions or safety gates. In an automation skill that can submit settlement results for prediction-market conditions, vague triggering increases the chance the agent invokes it in the wrong context, including premature or force-mode submissions based on incomplete evidence.

Static analysis

No suspicious patterns detected.