BYOCB ArbInjectionSkill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:05 AM UTC
• Version: 1.0.0

Overview

The skill appears to be a legitimate blockchain vulnerability monitor, but it needs review because it installs mutable external code and recommends recurring unattended updates.

Review this skill before installing. Prefer a pinned, reviewed release with included source and lockfile, avoid unattended git pull/npm install schedules, run it with minimal credentials and filesystem access, and confirm exactly what alert data will be sent to messaging providers.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T06 · System Persistence

Error

• Location: SKILL.md:108

Finding

Persistent Scheduled Update Mechanism

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 108–125
Vulnerability Type: Persistent scheduled task creation
Risk Level: Critical

The skill requires daily updates and provides a cron configuration targeting the main agent session:

markdown

## Maintenance

**Daily update required.** Detection patterns and fixes are pushed frequently.

```bash
cd /path/to/arb-injection
git pull origin main
npm install  # If package.json changed

Schedule daily update check (09:00):

json

{
  "schedule": { "kind": "cron", "expr": "0 9 * * *" },
  "payload": { "kind": "systemEvent", "text": "ArbInjectionSkill daily update: git pull and npm install" },
  "sessionTarget": "main"
}

text

### Technical Analysis

The documented configuration establishes a recurring task that survives the original skill invocation and targets the agent's main session. Its payload prompts repeated retrieval and installation of mutable upstream content. This creates a persistent execution channel whose future behavior depends on code controlled outside the audited artifact.

The scheduled task is not required for an on-demand contract scan. Combining persistence with `git pull origin main` and `npm install` means a future upstream change can reach the system without a new review of this skill package.

### Attack Path

1. A user or agent follows the maintenance instructions and registers the supplied cron schedule.
2. The scheduled task persists after the initial skill run.
3. At 09:00 each day, a system event targeting the main session requests a Git update and npm installation.
4. An attacker compromises the upstream repository, a maintainer account, or an included dependency.
5. A subsequent update retrieves the attacker-controlled change.
6. `npm install` may execute dependency lifecycle scripts with the permissions of the agent or user running the command.
7. The recurring schedule provides repeated opportunities to retrieve and execute modified content.

### Impac
...[truncated 463 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the automatic cron configuration and all requirements to perform unattended daily updates.
• Require explicit user approval for every update and installation.
• Do not target the main agent session with recurring installation instructions.
• Pin the repository to a reviewed immutable commit instead of tracking main.
• Display the exact revision and dependency changes before allowing execution.
• Require a new security review whenever executable code or dependency manifests change.
• If update notifications are necessary, make them informational only and do not automatically retrieve or install content.
• Document how users can locate and remove any previously registered scheduled task.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:16

Finding

Execution of Mutable Code Retrieved from an External Repository

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16–22
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

The installation procedure clones an unpinned external repository and immediately invokes npm:

markdown

## Install

```bash
git clone https://github.com/BringYourOwnBot/arb-injection.git
cd arb-injection
npm install

text

### Technical Analysis

The audited artifact does not contain the scanner implementation, `package.json`, dependency lockfile, or npm lifecycle scripts. Instead, it delegates installation to the current state of an external repository. Because no commit hash or signed release is specified, the effective payload can change after this audit.

Running `npm install` is security-sensitive because npm packages may define lifecycle hooks such as `preinstall`, `install`, and `postinstall`. Those hooks can execute local commands during installation. Thus, cloning mutable remote content and invoking npm creates a direct remote-code execution channel if the repository or its dependency chain is compromised.

### Attack Path

1. A user follows the documented installation procedure.
2. Git retrieves the current default branch from the external repository.
3. An attacker compromises the repository, a maintainer account, or release process and modifies the package manifest or installation scripts.
4. The user receives the modified content because the instructions do not pin an immutable revision.
5. The user runs `npm install`.
6. A malicious package lifecycle hook or installed component executes with the user's permissions.
7. The payload can access resources available to the installation process and may modify the subsequently launched monitor.

### Impact Assessment

The maximum impact is arbitrary code execution under the installing user's account. The payload could read or alter project files, access environment variables such as configured API keys, make outbound network requests, manipulate scan
...[truncated 183 chars]

Remediation

View remediation

Remediation Suggestions

• Include the complete scanner source and dependency metadata in the auditable skill package.
• Pin the external source to a reviewed commit hash or cryptographically verified release.
• Verify release signatures and expected source hashes before installation.
• Avoid invoking package managers immediately after retrieving mutable remote content.
• Require a manual review of source changes, package manifests, and lifecycle scripts before execution.
• Run installation and scanning in a sandbox with minimal filesystem, environment, and network access.
• Use a dedicated unprivileged account and expose only the resources required for contract scanning.
• Re-audit the package whenever the pinned revision changes.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:18

Finding

Unauditable and Unpinned npm Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18–22
Vulnerability Type: Unsafe third-party dependency installation
Risk Level: High

The skill directs users to install dependencies from the externally retrieved project:

bash

git clone https://github.com/BringYourOwnBot/arb-injection.git
cd arb-injection
npm install

Technical Analysis

The local artifact contains only SKILL.md. It does not provide a package.json, a lockfile, integrity hashes, an approved dependency inventory, or copies of required packages. As a result, dependency names, resolved versions, transitive components, package sources, and installation hooks cannot be reviewed from the submitted project.

The use of npm install, rather than a reproducible installation based on a reviewed lockfile, may resolve dependency versions according to externally controlled metadata. npm lifecycle scripts can also execute during installation. This exposes the user to compromised packages, dependency confusion, unsafe transitive dependencies, and malicious installation hooks.

Attack Path

1. The user clones the referenced project and runs npm install.
2. npm reads dependency metadata that was not included in this audit.
3. npm resolves packages and transitive dependencies from configured registries.
4. An attacker compromises a referenced package, publishes a malicious version accepted by the dependency range, or introduces a harmful lifecycle script through the upstream repository.
5. npm downloads the affected package.
6. Installation hooks execute, or malicious code runs when the monitor starts.
7. The dependency gains the process permissions and resource access available to the user running the installation or monitor.

Impact Assessment

A malicious dependency or lifecycle hook could execute arbitrary commands, read local files and environment variables, alter generated vulnerability reports, tamper with monitoring logic, or communicate with external system ...[truncated 206 chars]

Remediation

View remediation

Remediation Suggestions

• Add a reviewed package.json and lockfile to the submitted artifact.
• Pin all direct and transitive dependencies to exact versions with integrity hashes.
• Use npm ci for reproducible installation instead of unconstrained npm install.
• Use npm ci --ignore-scripts when lifecycle scripts are unnecessary.
• If lifecycle scripts are required, document and audit each script before permitting execution.
• Configure an approved package registry and apply dependency allowlisting.
• Generate and review a software bill of materials.
• Run automated vulnerability and package-provenance checks in CI.
• Perform dependency updates through reviewed pull requests rather than unattended branch pulls.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill explicitly instructs automatic background monitoring and immediate notification over third-party messaging channels, but it does not disclose the privacy and data-sharing implications of transmitting findings externally. Even if the scanned target is public blockchain data, alerts may include user-linked preferences, monitoring interests, or sensitive investigative context that could be exposed to external providers or unintended recipients.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The maintenance section recommends unattended daily 'git pull' and 'npm install', which can fetch and execute unreviewed code and lifecycle scripts from upstream repositories and package dependencies. This creates a software supply-chain risk that could compromise the host environment if the repository, dependency graph, or package registry account is maliciously modified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.