Security audit

NEAR Protocol CLI installation and setup guide.

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent NEAR CLI guide, but it recommends unsafe install commands and mainnet wallet actions without enough safeguards.

Review this skill before installing. Prefer a pinned, verified NEAR CLI release; do not run curl-to-sh or unpinned npx/npm commands automatically. Use testnet or read-only commands by default, never share seed phrases or private keys with an agent, and require explicit confirmation before any mainnet signing, transfer, staking, deployment, or account import/export action.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:21
Finding: Mutable Remote Installer Is Downloaded and Executed Without Integrity Verification
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:21, SKILL.md:234, SKILL.md:254; README.md:42, README.md:156-157
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Complete Vulnerable Code Snippets:

bash
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/near/near-cli-rs/releases/latest/download/near-cli-rs-installer.sh | sh

bash
curl --proto '=https' --tlsv1.2 -LsSf --connect-timeout 30 --max-time 300 https://github.com/near/near-cli-rs/releases/latest/download/near-cli-rs-installer.sh | sh

Technical Analysis

The installation instructions stream a remotely retrieved shell script directly into sh. Because the URL uses the mutable latest release path, the effective code executed by the command can change after this Skill has been reviewed.

HTTPS and the specified TLS settings protect the network transport, but they do not establish that the downloaded installer is the exact artifact that was previously audited. The instructions do not pin an immutable release, verify a cryptographic signature, or compare the installer against a trusted checksum before execution.

GitHub and the referenced NEAR repository are plausible upstream sources, but this does not eliminate risks from repository takeover, maintainer credential compromise, malicious release publication, CI/CD compromise, or replacement of a release asset. Piping directly to a shell also prevents a normal review step before execution.

Direct execution is not the minimum privilege or minimum-risk operation necessary to provide installation guidance. The installer can instead be downloaded as a regular file, verified, inspected, and then executed explicitly under an unprivileged account.

Attack Path

An attacker compromises an upstream maintainer account, repository release workflow, or release publishing token.

The attacker publishes or replaces the installer referenced by the mu ...[truncated 1073 chars]
Remediation: View remediation
Remediation Suggestions

Remove every direct curl | sh installation example.

Pin installation instructions to a specific, reviewed release rather than the mutable latest path.

Download the installer to a local file without executing it:
bash
curl --proto '=https' --tlsv1.2 -fL \ -o near-cli-rs-installer.sh \ https://github.com/near/near-cli-rs/releases/download/<pinned-version>/near-cli-rs-installer.sh

Obtain the expected SHA-256 digest or cryptographic signature through a trusted, publisher-controlled channel.

Verify the artifact before execution:
bash
printf '%s %s\n' '<trusted-sha256>' 'near-cli-rs-installer.sh' | sha256sum --check -

Encourage users to inspect the downloaded script before running it.

Execute the verified installer explicitly and as an unprivileged account:
bash
sh ./near-cli-rs-installer.sh

Document the files and configuration that the installer is expected to modify.

Prefer a package-manager installation with a pinned version and integrity metadata when a trusted package is available.

T08 · Insecure Dependencies

Warning

Location: SKILL.md:45
Finding: Unpinned npm and npx Installation Executes Mutable Registry Packages
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:45-52; README.md:47-53
Vulnerability Type: Insecure dependency installation
Risk Level: Medium

Complete Vulnerable Code Snippet:

bash
# Run directly without installation npx near-cli-rs # Install globally npm install -g near-cli-rs # Or add to package.json npm install --save-dev near-cli-rs

Technical Analysis

The instructions retrieve near-cli-rs from the npm registry without specifying a reviewed version or integrity value. In particular, npx near-cli-rs may download and execute the registry package immediately. The globally installed and development dependency variants also resolve a mutable registry version according to npm's current resolution rules.

The audit found no evidence that the named package itself is malicious. The vulnerability is the absence of version and integrity controls in instructions intended for automated agents. A future compromised or maliciously published package version could therefore be selected without any change to this Skill.

Installing globally also increases the persistence and scope of the package compared with a project-local, version-pinned installation. Global installation is not necessary for all declared uses because the documentation already supports local execution.

Attack Path

An attacker compromises the npm publisher account or package release process for near-cli-rs.

The attacker publishes a malicious package version or modifies the distribution tag selected by unpinned installation commands.

A user or AI agent executes npx near-cli-rs, npm install -g near-cli-rs, or npm install --save-dev near-cli-rs.

npm retrieves the attacker-controlled version.

Package lifecycle scripts or the invoked CLI execute with the permissions of the npm process.

For global installation, the malicious component remains available through the user's global executable path.

...[truncated 597 chars]
Remediation: View remediation
Remediation Suggestions

Pin all examples to a specific reviewed package version:
bash
npx --package near-cli-rs@<reviewed-version> near npm install --save-dev near-cli-rs@<reviewed-version>

Confirm the exact executable syntax supported by the pinned package before publishing the revised command.

Use a committed lockfile with npm integrity metadata for project-local installations.

Prefer project-local installation over global installation so the dependency is isolated and auditable.

Avoid running npm as root or through sudo.

Review package provenance, publisher identity, lifecycle scripts, and release history before updating the pinned version.

In automated environments, use npm ci against a reviewed lockfile and disable lifecycle scripts where they are not required:
bash
npm ci --ignore-scripts

Treat every version update as a supply-chain review event rather than automatically following the registry's latest tag.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (28)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: The | sh pipeline chains network retrieval directly into shell execution, removing the opportunity for inspection and making compromise of the source immediately exploitable. This is a classic dangerous execution pattern, especially risky in AI-agent workflows that may follow README instructions automatically.
Content: Scanner excerpt · README.md (reported line 42)May include surrounding context.
Linux/macOS/WSL (recommended):

bash
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/near/near-cli-rs/releases/latest/download/near-cli-rs-installer.sh | sh

npm/npx (any platform with Node.js):

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 96)May include surrounding context.
near tokens network-config mainnet now

Send NEAR tokens

near tokens send-near network-config mainnet sign-with-keychain send

text
### Staking

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 105)May include surrounding context.
near tokens network-config mainnet now

Send NEAR tokens

near tokens send-near network-config mainnet sign-with-keychain send

text
### Staking

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 111)May include surrounding context.
near tokens network-config mainnet now

Send NEAR tokens

near tokens send-near network-config mainnet sign-with-keychain send

text
### Staking

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 114)May include surrounding context.
near tokens network-config mainnet now

Send NEAR tokens

near tokens send-near network-config mainnet sign-with-keychain send

text
### Staking

Chaining Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: This second | sh occurrence has the same direct-code-execution risk as the initial installer example. Because it appears in troubleshooting, users may be more likely to run it under pressure, increasing the chance of unsafe execution without review.
Content: Scanner excerpt · README.md (reported line 168)May include surrounding context.
bash
# Use longer timeout curl --proto '=https' --tlsv1.2 -LsSf --connect-timeout 30 --max-time 300 \ https://github.com/near/near-cli-rs/releases/latest/download/near-cli-rs-installer.sh | sh

📚 Resources

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: The pipe into sh is the dangerous component that turns a network fetch into immediate command execution, preventing inspection and validation. In an automated agent workflow, this can directly enable arbitrary remote code execution with the agent's privileges.
Content: Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.
Best for: Most Linux and macOS users

bash
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/near/near-cli-rs/releases/latest/download/near-cli-rs-installer.sh | sh

if not add near to PATH:

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · README.md (reported line 130)May include surrounding context.
, WSL)

Best for: Most Linux and macOS users

bash
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/near/near-cli-rs/releases/latest/download/near-cli-rs-installer.sh | sh

if not add near to PATH: find the near binary by whereis near

Add to PATH:

bash
# Temporary (current session only) export PATH="$HOME/.cargo/bin:$PATH" # Permanent (add to your shell config) echo 'export PATH="$HOME/.cargo/bin:$PATH"' >> ~/.bashrc # For bash echo 'export PATH="$HOME/.cargo/bin:$PATH"' >> ~/.zshrc # For zsh

Reload your shell or run:

bash
source ~/.bashrc # or ~/.zshrc

Option 2: npm/npx (Any Platform with Node.js)

Best for: JavaScript/TypeScript developers, Windows users

Run directly without installation:

bash
npx near-cli-rs

Install globally:

bash
npm install -g near-cli-rs

Or add to package.json:

bash
npm install --save-dev near-cli-rs

Then use:

bash
npx near-cli-rs

Option 3: Windows Insta

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.
, WSL)

Best for: Most Linux and macOS users

bash
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/near/near-cli-rs/releases/latest/download/near-cli-rs-installer.sh | sh

if not add near to PATH: find the near binary by whereis near

Add to PATH:

bash
# Temporary (current session only) export PATH="$HOME/.cargo/bin:$PATH" # Permanent (add to your shell config) echo 'export PATH="$HOME/.cargo/bin:$PATH"' >> ~/.bashrc # For bash echo 'export PATH="$HOME/.cargo/bin:$PATH"' >> ~/.zshrc # For zsh

Reload your shell or run:

bash
source ~/.bashrc # or ~/.zshrc

Option 2: npm/npx (Any Platform with Node.js)

Best for: JavaScript/TypeScript developers, Windows users

Run directly without installation:

bash
npx near-cli-rs

Install globally:

bash
npm install -g near-cli-rs

Or add to package.json:

bash
npm install --save-dev near-cli-rs

Then use:

bash
npx near-cli-rs

Option 3: Windows Insta

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: This is the same direct execution chain as above and remains high risk regardless of timeout flags. The command creates a single-step trust boundary bypass from internet content to shell execution.
Content: Scanner excerpt · SKILL.md (reported line 234)May include surrounding context.
Solution:

bash
# Use a longer timeout with curl curl --proto '=https' --tlsv1.2 -LsSf --connect-timeout 30 --max-time 300 https://github.com/near/near-cli-rs/releases/latest/download/near-cli-rs-installer.sh | sh

Version Information

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: Presenting curl ... | sh in the quick reference normalizes a high-risk execution chain and is likely to be reused without scrutiny. In security-sensitive agent environments, this pattern is unacceptable because it couples retrieval and execution of mutable remote content.
Content: Scanner excerpt · SKILL.md (reported line 254)May include surrounding context.
bash
# Install (Shell script) curl --proto '=https' --tlsv1.2 -LsSf https://github.com/near/near-cli-rs/releases/latest/download/near-cli-rs-installer.sh | sh # Install (npx) npx near-cli-rs

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README recommends piping a remotely fetched installer script directly into sh without any safety warning or verification step. This is dangerous because it executes network-delivered code immediately, exposing users and agents to supply-chain compromise if the source, redirect, or release artifact is tampered with.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 85% confidence
Finding: The README recommends running npx near-cli-rs without pinning a specific version, which causes execution of whatever package version is current at invocation time. In an agent or automated environment, this creates supply-chain risk because behavior can change unexpectedly or a compromised upstream release could be executed.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 83)May include surrounding context.
md
# Import existing account near account import-account # Create new account near account create-account # Export account credentials

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This section documents real blockchain operations like token transfers, staking, deployment, and contract calls on mainnet without a prominent warning that these actions can move assets, incur fees, or create irreversible on-chain effects. In an agent skill, omission of such warnings increases the chance of unintended financial loss from blindly following examples.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Using npx near-cli-rs without pinning a specific package version makes execution non-deterministic and trusts whatever version is current in the registry at runtime. If the upstream package is compromised or a breaking release is published, an agent could execute unexpected code.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This invocation again relies on an unpinned npx package resolution path, which allows upstream changes to alter behavior without review. In an agent context, this increases supply-chain risk because the tool may be fetched and executed automatically.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.
Linux users may need:

bash
# Debian/Ubuntu sudo apt install libudev-dev # Fedora/Red Hat sudo dnf install libudev-devel

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 98)May include surrounding context.
Linux users may need:

bash
# Debian/Ubuntu sudo apt install libudev-dev # Fedora/Red Hat sudo dnf install libudev-devel

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill documents account import, account creation, contract, token, staking, and transaction-capable commands without clearly warning that they may use wallet credentials, prompt for sensitive material, or create irreversible on-chain effects. In an agent setting, this can lead to unintended signing flows, fund movement, or exposure of sensitive wallet context.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.
md
Follow the interactive prompts to sign in. ### Create a New Account If you don't have an account yet:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 224)May include surrounding context.
Solution:

bash
# Check the releases page manually curl -s https://api.github.com/repos/near/near-cli-rs/releases/latest | grep "browser_download_url" | grep "installer.sh"

Installation hangs or is slow

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The quick reference repeats execution of an unpinned package via npx, which is a supply-chain risk and can produce inconsistent agent behavior over time. Because this is presented as a copy-paste command, it is likely to be used directly.
Content: No source excerpt is available for this finding.

External Script Fetching

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: Fetching and executing an external installer from a live release URL introduces supply-chain risk because the downloaded content is not pinned or integrity-checked. In an agent context this is more dangerous, since automation may execute it non-interactively and at scale.
Content: Scanner excerpt · README.md (reported line 42)May include surrounding context.
Linux/macOS/WSL (recommended):

bash
curl --proto '=https' --tlsv1.2 -LsSf https://github.com/near/near-cli-rs/releases/latest/download/near-cli-rs-installer.sh | sh

npm/npx (any platform with Node.js):

External Script Fetching

Low

Category: Supply Chain
Confidence: 95% confidence
Finding: This troubleshooting variant repeats the same unsafe pattern of executing a remotely fetched installer script directly from a mutable URL. The longer timeout does not reduce the underlying risk of arbitrary upstream code execution.
Content: Scanner excerpt · README.md (reported line 167)May include surrounding context.
bash
# Use longer timeout curl --proto '=https' --tlsv1.2 -LsSf --connect-timeout 30 --max-time 300 \ https://github.com/near/near-cli-rs/releases/latest/download/near-cli-rs-installer.sh | sh

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T03 · Remote Payload Retrieval and Execution

Vulnerability Details

Technical Analysis

Attack Path

Remediation Suggestions

T08 · Insecure Dependencies

Vulnerability Details

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Chaining Abuse

Credential Access

Send NEAR tokens

Credential Access

Send NEAR tokens

Credential Access

Send NEAR tokens

Credential Access

Send NEAR tokens

Chaining Abuse

📚 Resources

Chaining Abuse

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

Option 2: npm/npx (Any Platform with Node.js)

Option 3: Windows Insta

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

Option 2: npm/npx (Any Platform with Node.js)

Option 3: Windows Insta

Chaining Abuse

Version Information

Chaining Abuse

Missing User Warnings

Rp1

Session Persistence

Missing User Warnings

Rp1

Rp1

Sudo/Root Execution

Sudo/Root Execution

Missing User Warnings

Session Persistence

External Transmission

Installation hangs or is slow

Rp1

External Script Fetching

External Script Fetching

Static analysis