T09 Β· Insecure Skill Coding Practices
Error
- Location
scripts/register-name.js:341- Finding
Unvalidated API Response Controls a Paid Blockchain Transaction
- Content
View full analysis
- Remediation
View remediation
Security audit
Nadname Agent
Security checks for vulnerabilities and agentic risk
Overview
This skill is not clearly malicious, but it handles wallet keys and irreversible blockchain transactions with several under-disclosed or unsafe behaviors users should review first.
Review this skill before installing. Use only a low-value wallet, prefer dry-run first, do not rely on its availability or ownership lookup as authoritative, and avoid managed keystore mode until the plaintext fallback, custom encryption, transaction validation, and explicit confirmation issues are fixed.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (6)
T09 Β· Insecure Skill Coding Practices
Warning
- Location
scripts/check-name.js:252- Finding
Availability Checker Reports Simulated Guesses as On-Chain Results
- Content
View full analysis
- Remediation
View remediation
T09 Β· Insecure Skill Coding Practices
Warning
- Location
scripts/my-names.js:91- Finding
Owned-Name Lookup Uses Address-Based Mock Data Instead of the NNS Contract
- Content
View full analysis
'); console.log(' node scripts/register-name.js --name '); return; } ``` ### Technical Analysis The script's documented purpose is to list names owned by an address, but `lookupNames()` does not query the NNS contract or an indexer. It constructs mock ownership records when the textual address contains `beef` or `dead`, and otherwise reports that no names were found. The output notes simula ...[truncated 1064 chars]- Remediation
View remediation
T09 Β· Insecure Skill Coding Practices
Warning
- Location
scripts/register-name.js:289- Finding
Managed Keystore Uses Deprecated Cipher APIs and Ignores the Generated IV
- Content
View full analysis
- Remediation
View remediation
T09 Β· Insecure Skill Coding Practices
Warning
- Location
scripts/register-name.js:199- Finding
Managed Mode Silently Accepts an Unencrypted Private-Key File
- Content
View full analysis
- Remediation
View remediation
T08 Β· Insecure Dependencies
Note
- Location
package.json:10- Finding
Unpinned Dependency Resolution Prevents Reproducible Installation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (28)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill is presented as a naming-service registration tool, but the analysis indicates it also involves local wallet creation, keystore handling, and potential storage of private keys or mnemonic backups on disk. That is materially more sensitive than the declared purpose, and hidden credential-management behavior in an agent skill can lead to secret theft, insecure storage, or irreversible blockchain account compromise.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill is presented as a naming-service registration tool, but the analysis indicates it also involves local wallet creation, keystore handling, and potential storage of private keys or mnemonic backups on disk. That is materially more sensitive than the declared purpose, and hidden credential-management behavior in an agent skill can lead to secret theft, insecure storage, or irreversible blockchain account compromise.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill is presented as a naming-service registration tool, but the analysis indicates it also involves local wallet creation, keystore handling, and potential storage of private keys or mnemonic backups on disk. That is materially more sensitive than the declared purpose, and hidden credential-management behavior in an agent skill can lead to secret theft, insecure storage, or irreversible blockchain account compromise.
- Content
YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]
High
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
- Content
md --- name: NadName Agent description: "π Register .nad names on Monad blockchain via Nad Name Service (NNS). Real API integration with registerWithSignature, dynamic gas estimation, permanent ownership." --- # π NadName Agent v2.0 - .nad Names on Monad > Register permanent .nad names on Monad blockchain via Nad Name Service with real API integration **TL;DR:** Get `yourname.nad` on Monad. One-time fee, lifetime ownership. Now with real NAD API integration and accurate pricing! ## What is NNS? **Nad Name Service (NNS)** is a web3 name service built on Monad blockchain that maps human-readable names like `age
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/check-name.js myname
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/check-name.js myname
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/check-name.js myname
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/check-name.js myname
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/check-name.js myname
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/check-name.js myname
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/check-name.js myname
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/check-name.js myname
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/my-names.js
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/my-names.js
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/my-names.js
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/my-names.js
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/my-names.js
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/my-names.js
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script advertises accurate blockchain-backed availability checks, but its fallback logic does not query the NNS contract and instead fabricates availability based on a hardcoded list plus optimistic defaults. Users may rely on false 'available' results and proceed toward registration attempts, causing misinformed decisions, failed transactions, or trust abuse in a blockchain registration workflow where correctness is security-relevant.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The inline comments and function naming state that an on-chain availability check is performed, but the implementation only simulates results and even returns 'available' on errors. In the context of a blockchain naming/registration tool, this deceptive behavior can mislead operators and downstream automation into trusting unverified state, increasing the chance of failed or wasteful transactions.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file and surrounding skill metadata imply real NNS functionality, but this script only performs read-only lookup behavior and even relies on simulated results. This is dangerous because users may make operational decisions based on false blockchain state, and the mismatch undermines trust in a wallet- or blockchain-facing tool.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README instructs users to export a private key and run a registration command, but it does not clearly warn that this will submit a real blockchain transaction that spends funds and is generally irreversible once confirmed. In a blockchain-registration skill with real API integration, this omission can cause users to trigger unintended on-chain actions or fees under the assumption they are performing a harmless local test.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill documents use of the PRIVATE_KEY environment variable and managed keystore flows, but the manifest declares no explicit tool scope or permission boundary for environment access. In an agent setting, undeclared access to secrets increases the risk of accidental credential exposure or misuse because operators cannot clearly constrain what the skill is allowed to read.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Step 1: Get Registration Data
bash POST https://api.nad.domains/api/register-request Body: { "name": "myname", "owner": "0x...",
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The implementation explicitly enters simulation mode and fabricates name ownership results based on address substrings rather than querying the contract. In a blockchain naming context, presenting mock data as if it were authoritative can mislead users about ownership, primary names, or account state.
- Content
Static analysis
No suspicious patterns detected.