Modern Ethereum & EVM Developer

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:01 PM UTC
• Version: 1.0.0

Overview

This Ethereum agent guide is mostly purpose-aligned, but it needs Review because it includes wallet/payment automation and unpinned remote instructions without enough spending, endpoint, or dependency controls.

Install only if you are comfortable reviewing each wallet, payment, deployment, and package-install step. Use a dedicated low-balance wallet, require explicit approval for every transfer or x402 payment, pin dependency versions, avoid loading remote SKILL.md files unless you review them first, and treat all NEXT_PUBLIC environment values as public.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:1594

Finding

Unbounded Autonomous Payment Authorization to Dynamically Selected Endpoints

Content

View full analysis

85 // 3-5. Pay + Receive: x402Fetch handles the entire 402 flow const response = await x402Fetch(agentEndpoint, { wallet, preferredNetwork: 'eip155:8453' }); const weatherData = await response.json(); ``` The associated documented flow explicitly states: ```text 3. CALL Agent sends HTTP GET to weather endpoint → receives 402 Payment Required → PAYMENT-REQUIRED header: $0.10 USDC on Base 4. PAY Agent signs EIP-3009 transferWithAuthorization → retries request with PAYMENT-SIGNATURE → server verifies via facilitator → payment settled on Base (~$0.001 gas) ``` ### Technical Analysis The Skill directs an agent to create a signing wallet from `AGENT_PRIVATE_KEY` and pass that wallet to `x402Fetch`. The helper automatically processes an HTTP 402 response, signs an EIP-3009 payment authorization, and transmits the authorization to ...[truncated 2593 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:2741

Finding

RPC API Credentials Exposed Through a Public Next.js Environment Variable

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:981

Finding

Unpinned Third-Party Packages Are Downloaded and Executed

Content

View full analysis

yarn install yarn fork --network base # Terminal 1: fork of real Base yarn deploy # Terminal 2: deploy contracts to fork yarn start # Terminal 3: Next.js frontend ``` ### Technical Analysis The Skill instructs users and agents to download packages without exact versions or integrity constraints. In particular, `npx create-eth@latest` fetches and executes the package version designated as `latest` at invocation time. Consequently, the effective code executed by the Skill can change after the Skill itself has been reviewed. The x402 packages are especially sensitive because the examples give them access to wallet signing functionality. A malicious or compromised package release could inspect process environment variables, local wallet files, source repositories, deployment credentials, or signed payment data. No evidence in the audited file establishes that the named packages are currently malicious, typosquatted, or dependency-confused. The confirmed issue is the unsafe, mutable dependency acquisition and execution practice, not a confirmed compromise of a specific upstream package. ### Attack Path 1. An upstream package maintainer account, package registry, release process, or transitive dependency is compromised. 2. A malicious release is published under the referenced package name or assigned the `latest` tag. 3. ...[truncated 1308 chars]

Remediation

View remediation

` rather than `@latest`. - Pin exact x402 package versions. - Pin Python dependencies with hashes. 2. Commit and enforce lockfiles: - Use `npm ci`, `yarn --immutable`, or an equivalent frozen-lockfile mode. - Use `pip --require-hashes` with a generated requirements lock file. - Reject unexpected lockfile changes during CI. 3. Verify dependency provenance: - Confirm official package names and publishers. - Review release signatures, provenance attestations, and registry metadata. - Use package-manager integrity checks and trusted registries. - Audit transitive dependencies and lifecycle scripts. 4. Reduce installation privileges: - Install in an isolated container or sandbox. - Do not expose wallet keys, deployment tokens, SSH agents, or cloud credentials during package installation. - Disable lifecycle scripts where compatible with the package. - Avoid running package managers with administrator privileges. 5. Require manual review for dependency upgrades, particularly packages that receive wallet objects, sign transactions, create deployment scripts, or modify smart-contract source code. 6. Add software-composition analysis, secret scanning, and generated-code review to CI before any contract or frontend is deployed. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (19)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 321)May include surrounding context.

bash

# .gitignore (MUST exist in every project)
.env
.env.*
*.key
*.pem

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 1471)May include surrounding context.

bash

# .gitignore (MUST exist in every project)
.env
.env.*
*.key
*.pem

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 1476)May include surrounding context.

bash

# .gitignore (MUST exist in every project)
.env
.env.*
*.key
*.pem

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 1457)May include surrounding context.

md

[chains.base.id]: "https://base-mainnet.g.alchemy.com/v2/8GVG8WjDs-LEAKED",
},

// ✅ RIGHT — key stays in .env.local
rpcOverrides: {
  [chains.base.id]: process.env.NEXT_PUBLIC_BASE_RPC || "https://mainnet.base.org",
},

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 85% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 2202)May include surrounding context.

md

You already know how AMMs, lending, oracles, and stablecoins work. But your human might not. When they're designing something onchain, they need to understand these concepts — not the code, the *mental models*.

**Don't lecture.** Instead, when a concept is relevant to what they're building, explain it in context. Here's what to emphasize for each:

### The Approve Pattern
Humans find this weird. Explain it as: *"You're giving the contract permission to move your tokens, like signing a check. You control how much. Never sign a blank check (infinite approval)."*

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · SKILL.md (reported line 3128)May include surrounding context.

Step 4: Clean Build + IPFS Deploy 🤖

bash

cd packages/nextjs && rm -rf .next out
NEXT_PUBLIC_PRODUCTION_URL="https://myapp.yourname.eth.link" \
  NODE_OPTIONS="--require ./polyfill-localstorage.cjs" \
  NEXT_PUBLIC_IPFS_BUILD=true NEXT_PUBLIC_IGNORE_BUILD_ERROR=true \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 989)May include surrounding context.

md

import { createWallet } from '@x402/evm';

const wallet = createWallet(privateKey);
const response = await x402Fetch('https://api.example.com/data', {
  wallet,
  preferredNetwork: 'eip155:8453' // Base
});

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 2130)May include surrounding context.

md

→ WHO calls it every hour? WHY would they pay gas?
   → Fix: make it profitable to call. Or let users trigger it when they interact.

❌ "Expired listings get automatically removed"
   → Nothing is automatic. WHO removes them? WHY?
   → Fix: give callers a small reward, or let the next user's action clean up stale state.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 2702)May include surrounding context.

md

**Where to get prices:**
- **ETH price:** SE2 built-in hook — `useNativeCurrencyPrice()`
- **Custom tokens:** DexScreener API (`https://api.dexscreener.com/latest/dex/tokens/TOKEN_ADDRESS`), onchain Uniswap quoter, or Chainlink oracle

**This applies to both display AND input:**
- Displaying a balance? Show USD next to it.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 3021)May include surrounding context.

bash

ls out/*/index.html                  # Each route has a directory + index.html
curl -s -o /dev/null -w "%{http_code}" -L "https://GATEWAY/ipfs/CID/debug/"
# Should return 200, not 404

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 3040)May include surrounding context.

bash

# Via API:
curl -X PATCH "https://api.vercel.com/v9/projects/PROJECT_ID" \
  -H "Authorization: Bearer $VERCEL_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"rootDirectory": "packages/nextjs", "installCommand": "cd ../.. && yarn install"}'

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instruction "Say "onchain" not "on-chain."" imposes a language/style requirement rather than adapting to the user's preferred wording. Under the policy, forcing a specific language or locale convention without opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The phrase "Use "onchain" in all writing" is a blanket instruction that overrides user preference and context. This is a language-policy issue because it enforces a specific linguistic form instead of allowing user choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This line again instructs that the community says "onchain" rather than "on-chain," which reinforces a prescriptive language rule across the skill. Because it does not offer opt-in or user preference, it fits the language-policy violation category.

Content

No source excerpt is available for this finding.