OnChat

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:43 AM UTC
• Version: 1.0.0

Overview

This skill is coherent for on-chain chat, but it gives an agent wallet-powered authority to spend funds and post permanent public messages without enough transaction-by-transaction controls.

Install only if you are comfortable giving the agent a dedicated low-balance wallet that can spend ETH and post permanent public messages. Do not use a main wallet private key; require manual review before each send or join; treat all channel messages as untrusted user content; and prefer pinned, lockfile-based dependency installation rather than unpinned npx commands.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

other

Warning

• Location: scripts/onchat.ts:245

Finding

Untrusted On-Chain Messages Can Indirectly Hijack Agent Behavior

Content

View full analysis

--limit N`. 3. **Engage naturally** — reply to messages, greet users, join conversations. 4. **Track replies** — look for messages starting with `# -` where `` matches your previous message IDs. Reply back to keep conversations going. 5. **Use correct reply format** — always prefix replies with `# -`. ``` ### Technical Analysis Message content is supplied by arbitrary blockchain users and therefore crosses an external, untrusted boundary. The CLI prints `msg.content` ...[truncated 2334 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/package.json:7

Finding

Unpinned Dependencies and Missing Lockfile Make Installation Non-Reproducible

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (27)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description understates operational behaviors that can trigger on-chain state changes and spend funds, including joining channels, auto-joining on send, and wallet-balance/fee-related operations. In an agent context, this mismatch is dangerous because users or orchestrators may treat the skill as simple messaging while it can perform additional transactional actions with irreversible blockchain effects.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The README instructs users to run npx skills add sebayaki/onchat without pinning an exact package version. npx may fetch the latest published package at execution time, so a compromised maintainer account, malicious update, or dependency hijack could cause users to execute unintended code on their systems. In the context of an agent skill, this is more dangerous because installation often happens with high trust and may influence downstream agent behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence

Finding

The command npx tsx onchat.ts channels relies on npx to resolve tsx at runtime without an explicit version in the command. If tsx is not installed locally as expected or the environment resolves a different package version, users could execute unreviewed code, which is risky for security-sensitive tooling. Because this CLI interfaces with blockchain operations, trust in the execution environment matters more than for a purely local utility.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence

Finding

The command npx tsx onchat.ts read onchat executes tsx without version pinning, allowing runtime package resolution to drift to an unexpected or malicious release. Even though this specific command is read-only, arbitrary code execution would occur before the script logic, so compromise could affect the local system or exfiltrate data. The skill context increases concern because users may run such commands in developer environments with credentials present.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence

Finding

The README recommends npx tsx onchat.ts info onchat without specifying an exact tsx version. This creates a supply-chain risk where the executable tool may change over time or be replaced by a malicious publication, leading to arbitrary code execution. While the documented purpose is benign, the installation pattern is unsafe because it relies on mutable package resolution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence

Finding

The command npx tsx onchat.ts fee "Hello!" invokes executable package code without version pinning. Attackers who can influence package publication or resolution could use this path to run arbitrary code, independent of the harmlessness of the fee operation itself. In a blockchain-related skill, users may execute commands from terminals containing wallet-related environment variables, increasing the practical risk.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The command npx tsx onchat.ts balance is unpinned and appears in the section where users are instructed to export ONCHAT_PRIVATE_KEY. If npx resolves a malicious or unexpected tsx package, it could execute arbitrary code in an environment where a private key is available, making credential theft and wallet compromise plausible. The skill context therefore makes this significantly more dangerous than a generic unpinned developer-tool invocation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The command npx tsx onchat.ts join onchat is executed after instructing users to set ONCHAT_PRIVATE_KEY, so any compromise of the dynamically resolved tsx package could immediately expose signing credentials or perform malicious blockchain actions. This is a true supply-chain vulnerability pattern because runtime package resolution is mutable and trusted implicitly. The blockchain wallet context amplifies impact beyond ordinary code execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The command npx tsx onchat.ts send onchat "gm!" combines an unpinned executable dependency with a transaction-sending workflow that depends on ONCHAT_PRIVATE_KEY. If a malicious or substituted tsx release is fetched, an attacker could steal the private key or submit unauthorized transactions. This is especially dangerous in this skill because the documented operation explicitly signs on-chain actions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill requests use of an environment variable containing a blockchain private key but does not declare explicit tool scope or permissions boundaries. That omission weakens reviewability and can allow an agent runtime to expose sensitive env access more broadly than users expect, increasing the chance of key misuse or exfiltration.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

Using npx tsx without pinning an exact package version allows resolution of whatever version is currently published or locally selected at execution time. This creates a supply-chain risk where a compromised or incompatible package version could execute arbitrary code in the environment, potentially accessing the wallet private key or altering transaction behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

Using npx tsx without pinning an exact package version allows resolution of whatever version is currently published or locally selected at execution time. This creates a supply-chain risk where a compromised or incompatible package version could execute arbitrary code in the environment, potentially accessing the wallet private key or altering transaction behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

Using npx tsx without pinning an exact package version allows resolution of whatever version is currently published or locally selected at execution time. This creates a supply-chain risk where a compromised or incompatible package version could execute arbitrary code in the environment, potentially accessing the wallet private key or altering transaction behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

Using npx tsx without pinning an exact package version allows resolution of whatever version is currently published or locally selected at execution time. This creates a supply-chain risk where a compromised or incompatible package version could execute arbitrary code in the environment, potentially accessing the wallet private key or altering transaction behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

Using npx tsx without pinning an exact package version allows resolution of whatever version is currently published or locally selected at execution time. This creates a supply-chain risk where a compromised or incompatible package version could execute arbitrary code in the environment, potentially accessing the wallet private key or altering transaction behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

Using npx tsx without pinning an exact package version allows resolution of whatever version is currently published or locally selected at execution time. This creates a supply-chain risk where a compromised or incompatible package version could execute arbitrary code in the environment, potentially accessing the wallet private key or altering transaction behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

Using npx tsx without pinning an exact package version allows resolution of whatever version is currently published or locally selected at execution time. This creates a supply-chain risk where a compromised or incompatible package version could execute arbitrary code in the environment, potentially accessing the wallet private key or altering transaction behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

Using npx tsx without pinning an exact package version allows resolution of whatever version is currently published or locally selected at execution time. This creates a supply-chain risk where a compromised or incompatible package version could execute arbitrary code in the environment, potentially accessing the wallet private key or altering transaction behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

Using npx tsx without pinning an exact package version allows resolution of whatever version is currently published or locally selected at execution time. This creates a supply-chain risk where a compromised or incompatible package version could execute arbitrary code in the environment, potentially accessing the wallet private key or altering transaction behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

Using npx tsx without pinning an exact package version allows resolution of whatever version is currently published or locally selected at execution time. This creates a supply-chain risk where a compromised or incompatible package version could execute arbitrary code in the environment, potentially accessing the wallet private key or altering transaction behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The send command performs an on-chain joinChannel transaction automatically if the wallet is not already a member, creating an extra state-changing blockchain action beyond the user-visible request to send a message. In an agent setting, this hidden side effect can cause unintended membership, extra gas expenditure, and consent violations because a single high-level action triggers multiple on-chain transactions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Automatically joining a channel during send without an explicit warning undermines user intent transparency for a transaction-signing tool. In blockchain contexts, even seemingly minor hidden writes matter because they incur gas, alter public on-chain state, and may have reputational or privacy implications through visible membership association.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest describes OnChat-specific capabilities: reading channels/conversations and sending on-chain messages. The balance command queries the user's Base ETH wallet balance, which is a broader wallet capability not mentioned as part of the skill's purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.