BNB Chain

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:21 AM UTC
• Version: 0.1.0

Overview

This BNB Chain skill does what it claims, but it handles wallet private keys and can immediately send irreversible crypto transactions without a confirmation step.

Review this carefully before installing. Use it only with wallets and amounts you can afford to risk, avoid entering private keys on the command line, prefer a dedicated low-value wallet or safer signer, and manually verify recipient, token contract, amount, chain, and fees before any send operation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: bnb.js:125

Finding

Private Key Exposure Through Command-Line Arguments

Content

View full analysis

--key '); await sendBNB(args[0], args[1], sendKey); break; case 'send-token': const tokenKey = getKey(args); if (!args[0] || !args[1] || !args[2] || !tokenKey) throw new Error('Usage: bnb.js send-token --key '); await sendToken(args[0], args[1], args[2], tokenKey); break; case 'address': if (!args[0]) throw new Error('Usage: bnb.js address '); getAddress(args[0]); break; ``` The documentation explicitly encourages users to provide private keys on the command line: ```bash node bnb.js send [--key ] ``` ```bash node bnb.js send-token [--key ] ``` ```bash node bnb.js address ``` ### Technical Analysis The Skill accepts wallet private keys through `process.argv`, either after `--key` or as the positional argument to the `address` command. Command-line arguments are not an appropriate secret-transport mechanism because they may be exposed through: - Shell command history. - Process inspection facilities while the command is running. - Process-monitoring and endpoint-management software. - Diagnostic reports, terminal recordings, audit logs ...[truncated 2082 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description understates the skill's effective capabilities: it can consume private keys, derive wallet identity from them, and query transaction details beyond the stated balance/send operations. In a blockchain context, hidden or under-declared secret-handling behavior is especially dangerous because it can lead to unauthorized signing, fund transfer, or disclosure of sensitive wallet material.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.17.1 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The lockfile pins ws to 8.17.1, and the supplied advisory data identifies this version as affected by memory disclosure and memory-exhaustion denial-of-service issues. Even though ws is a transitive dependency of ethers rather than directly used here, this skill performs blockchain operations and may interact with remote RPC or websocket endpoints, making vulnerable networking code materially relevant.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill explicitly instructs use of the BNB_PRIVATE_KEY environment variable and accepts direct private-key input, but it declares no permissions or allowed tool scope to signal that secret access is required. This weakens reviewability and consent boundaries, making it easier for an agent or user to invoke secret-dependent behavior without clear upfront disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The examples encourage passing a private key via --key on the command line, which can expose the secret through shell history, process listings, logs, telemetry, and terminal scrollback. In a cryptocurrency-transfer skill, disclosure of a private key can immediately enable full wallet compromise and theft of funds.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill exposes additional capabilities beyond the stated manifest scope by providing transaction lookup and private-key-to-address derivation commands. While these operations are not inherently dangerous on their own, undocumented capability expansion increases attack surface and can mislead users or higher-level agents about what the skill is able to do, especially where private keys are accepted as direct input.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The tool accepts private keys via CLI arguments or environment variables without any warning or safer alternative. CLI arguments are commonly exposed through shell history, process listings, logs, and agent telemetry, so this design can leak wallet credentials and enable complete theft of funds.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The asset-transfer commands submit BNB or token transfers immediately once parameters are provided, with no confirmation prompt, recipient verification step, or safety interlock. In an agent or automation context, malformed inputs, prompt injection, or operator mistakes could cause irreversible loss of cryptocurrency.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown file describes the skill generically as handling 'Basic BNB Chain operations' and 'Check balances and send transactions' without specifying clear activation phrases, scope boundaries, or exclusion conditions. That ambiguity can cause unintended invocation for general blockchain-related requests rather than only the exact supported commands.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency version is specified with a caret range (^6.16.0), which allows newer compatible releases to be installed automatically. This creates supply-chain risk because a future compromised or breaking upstream release could be pulled into the skill without explicit review, which matters more here because the package is used for blockchain balance checks and transaction signing/broadcasting.

Content

Scanner excerpt · package.json (reported line 13)May include surrounding context.

json

"license": "ISC",
  "description": "",
  "dependencies": {
    "ethers": "^6.16.0"
  }
}

Static analysis

No suspicious patterns detected.