Security checks for vulnerabilities and agentic risk
Overview
This skill is openly about USDC prediction-market betting, but it gives agents enough authority to place repeated real-money bets without clear per-bet user confirmation or strong spending controls.
Review this skill carefully before installing. Only use it if you are comfortable giving an agent access to a USDC-backed betting account, and require your own per-bet confirmation, explicit spending limits, and a way to revoke or rotate the API key. Prefer an isolated, pinned CLI install over a global latest-version install.
### 1. Install the CLI
```bash
npm install -g @tbd-vote/cli
text
The same installation command is repeated at lines 131–134:
```text
┌──────────────────────────────────────────────────────────────────┐
│ INSTALL (one-time) │
│ │
│ npm install -g @tbd-vote/cli │
Technical Analysis
The skill instructs users to install the latest available release of @tbd-vote/cli globally without pinning a reviewed version or verifying package integrity. Because this project contains only skill.md and does not include the package's implementation, the audit cannot verify its lifecycle scripts, credential handling, network behavior, transaction construction, or future updates.
npm packages can execute package lifecycle scripts during installation. A global installation also makes the package's executable available system-wide. Consequently, compromise of the npm package, its maintainer account, or a future package release could introduce code that executes with the installing user's privileges.
This finding concerns supply-chain exposure created by the installation method. The audited file does not establish that the current npm package is malicious.
Attack Path
An attacker compromises the npm package, its publisher account, or a future unpinned release.
The attacker publishes a modified version containing a malicious lifecycle script or CLI implementation.
A user follows the skill's instruction and runs npm install -g @tbd-vote/cli.
npm retrieves the attacker-controlled latest release without requiring the user to approve a specific reviewed version.
...[truncated 1005 chars]
Remediation
View remediation
Remediation Suggestions
Pin the dependency to an exact, reviewed version rather than installing the latest release:
bash
Use --ignore-scripts only after confirming that legitimate installation does not require lifecycle scripts.
Publish the CLI source and reproducible build instructions so the installed artifact can be compared with reviewed source.
Verify the package tarball using a trusted integrity digest or signed provenance before installation.
Prefer a project-local or isolated installation over a global installation, and execute it under a dedicated, least-privileged account or sandbox.
Lock and periodically review transitive dependencies.
Require explicit user confirmation and enforce server-side spending limits before each financial transaction, reducing the impact of a compromised CLI.
Protect API keys with restrictive file permissions and support rapid credential revocation and rotation.
The skill explicitly encourages an agent-orchestrated autonomous loop that repeatedly checks balance, analyzes markets, and places real-money bets using USDC, but it does not require an explicit user confirmation step or prominently warn that funds can be spent and losses incurred. This creates a material risk of unauthorized or insufficiently informed financial actions, especially if an agent follows the loop automatically once authenticated.
Content
No source excerpt is available for this finding.
External Transmission
Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content
Scanner excerpt · skill.md (reported line 211)May include surrounding context.
The raw HTTP example includes a live POST request to place a bet against the production API, but it is presented as a straightforward example without adjacent warnings that it spends USDC and may be irreversible once submitted. This lowers the barrier for accidental execution by an agent or user copying commands verbatim, leading directly to unintended loss of funds.
