BNB Chain NFT

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:18 AM UTC
• Version: 0.1.0

Overview

This skill appears to be a real BNB Chain NFT tool, but it can sign transfers and collection-wide approvals with a raw private key without strong safeguards.

Install only if you intend to let this skill perform real NFT transactions. Use a dedicated low-value wallet, prefer environment-based secrets over --key, verify every contract, recipient, spender, and operator address yourself, and treat approve-all as granting broad control until you revoke it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill documents capabilities that require network access and consumption of sensitive credentials from environment variables, but it does not declare corresponding permissions. This creates a transparency and governance gap: operators may invoke or install the skill without understanding that it can access a private key and perform blockchain interactions, including state-changing transactions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The public description frames the skill mainly as informational NFT operations plus transfers, but the documented behavior also includes approval and approve-all functionality. Approval-for-all is especially sensitive because it can grant broad control over a user's entire NFT collection to an operator, so omitting this from the declared purpose materially understates the skill's authority and increases the chance of unsafe invocation.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The skill exposes approval primitives (`approve`, `setApprovalForAll`, and approval state checks) that go beyond the stated manifest description of metadata, ownership, listing, transfer, and collection info. In an agent/tooling context, broad approval operations are especially dangerous because `setApprovalForAll` can delegate full collection-wide transfer authority to another address, enabling asset theft if invoked on behalf of a user without clear consent.

Description-Behavior Mismatch

Low

• Confidence: 88% confidence
• Finding: `getMetadata` performs arbitrary outbound HTTP fetches based on untrusted `tokenURI` values stored on-chain, but this network behavior is not disclosed in the skill description. This can be abused for unexpected egress, interaction with attacker-controlled infrastructure, or fetching oversized/malicious content, which is more concerning in constrained or sensitive runtime environments.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The code accepts private keys from CLI arguments or environment variables and uses them for transfer and approval transactions, including broad approval delegation. In an agent skill, secret ingestion combined with high-risk signing actions creates a direct path to irreversible asset loss if the tool is invoked incorrectly, logged, or manipulated into authorizing a malicious address.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The phrase 'Use for any NFT-related tasks on BSC' is overly broad and can cause the agent to invoke this skill in situations beyond the narrowly intended operations. In context, that is more dangerous because the skill includes write actions and approval-setting behavior tied to a private key, so over-invocation could lead to unnecessary exposure of secrets or unintended on-chain transactions.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The CLI explicitly encourages passing the private key via `--key`, which exposes the secret through shell history, process listings, job control logs, and agent telemetry. Even if the code does not print the key, the invocation pattern itself creates a practical credential leakage risk that can lead to wallet compromise.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: `approve-all` grants another address authority to transfer every NFT in the collection for the caller, yet the skill performs no explicit safety warning, scoped confirmation, or operator validation before submitting the transaction. In the context of an agent skill, this is highly dangerous because a single mistaken or manipulated invocation can irreversibly delegate full control of the user’s NFTs to an attacker.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"license": "ISC",
  "description": "BNB Chain NFT operations",
  "dependencies": {
    "ethers": "^6.16.0"
  }
}

• Confidence: 91% confidence
• Finding: "ethers": "^6.16.0"

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: nft.js:5