Security audit

Airdrop Hunter

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-built for a Web3 airdrop workflow, but it under-discloses automatic external URL checks and persistent MCP credentials.

Review before installing. Use it only if you are comfortable sending airdrop URLs and project names to Antalpha's MCP service, and require a secure secret store for the MCP api_key. Avoid pasting private, signed, reset, invite, or token-bearing URLs unless you strip query strings and fragments first. Treat scam-check results as advisory and independently verify official domains before connecting any wallet or signing transactions.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

other

Warning

Location: SKILL.md:24
Finding: Automatic Disclosure of User-Provided URLs to an External MCP Service
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:24-29 and SKILL.md:67-72
Vulnerability Type: Automatic external transmission of potentially sensitive URL data
Risk Level: Medium

Vulnerable Code Snippet

markdown
| Field | Value | |-------|-------| | **Endpoint** | `https://mcp-skills.ai.antalpha.com/mcp` | | **Transport** | `streamable-http` | **First-run registration** (one time): call `antalpha-register` to obtain your `agent_id` and `api_key`. Persist both. Pass `agent_id` on every subsequent tool call. Without registration, tool calls will be rejected.

markdown
## 2. Automation Triggers (MANDATORY) | User Input Pattern | Auto-Execute Tool | Reason | |--------------------|-------------------|--------| | User provides a URL (with or without context) | `airdrop-scam-check` | Safety first. Verify before they click. |

Technical Analysis

The Skill mandates that any URL supplied by a user be processed through airdrop-scam-check, which is hosted at the external Antalpha MCP endpoint. No consent prompt, data-minimization step, or local preprocessing requirement is defined before transmission.

Although URL reputation checking is related to the declared scam-detection functionality, transmitting the complete URL is not always the minimum privilege necessary. URLs may contain sensitive material in their path, query string, or fragment, including:

Signed download or document-access tokens

Password-reset and authentication tokens

Private invitation codes

User or account identifiers

Internal hostnames and resource paths

Marketing or referral identifiers

The persistent agent_id required on subsequent requests also permits requests to be correlated across interactions. The audited project does not specify whether URL query parameters are removed, whether submitted data is retained, or whether the user is informed of the external destination.

The static pre-scan identified README.md as containing a sensitive- ...[truncated 1261 chars]
Remediation: View remediation
Remediation Suggestions

Require explicit user consent before transmitting a URL to the external MCP service.

Clearly identify the destination service and explain what information will be transmitted.

Parse URLs locally and remove user information, query strings, and fragments by default.

Detect common credential parameters such as token, key, signature, auth, and code, and refuse transmission until they are removed.

Send only the normalized hostname when that is sufficient for domain-reputation analysis.

Provide a local-only or opt-out workflow for users who do not consent to external processing.

Publish the MCP service's data retention, logging, deletion, and privacy policies.

Avoid including the stable agent_id where the remote operation does not require account correlation.

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:27
Finding: Unspecified Persistent Storage of MCP API Credentials
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:27-29
Vulnerability Type: Insecure credential persistence requirements
Risk Level: Medium

Vulnerable Code Snippet

markdown
**First-run registration** (one time): call `antalpha-register` to obtain your `agent_id` and `api_key`. Persist both. Pass `agent_id` on every subsequent tool call. Without registration, tool calls will be rejected.

The persistence requirement also conflicts with the following security statement at SKILL.md:237-240:

markdown
## 12. Security Notes - **Data Sources**: Public APIs (DefiLlama), no user credentials required - **No Local Server**: This skill does not start any local HTTP server - **No File Persistence**: No user data is stored locally - **Disclaimer**: This is not financial advice. Always DYOR. Never share private keys.

Technical Analysis

The Skill explicitly requires the Agent to persist an api_key and agent_id, but it does not specify an approved secret-storage mechanism or impose controls concerning:

Encryption at rest

File permissions

Prevention of logging or transcript exposure

Credential lifetime and rotation

Revocation and deletion

Isolation between users or workspaces

Redaction from errors and diagnostic output

An Agent following the instruction literally could store the API key in plaintext memory files, ordinary configuration files, logs, or a shared workspace. Persistent API credentials must be treated as secrets even if they do not directly represent user credentials.

The “No File Persistence” statement does not resolve this risk because the required persistence mechanism is unspecified. It instead creates ambiguity that may result in implementation-dependent and insecure storage.

Attack Path

The Agent invokes antalpha-register.

The external service returns an agent_id and api_key.

The Skill instructs the Agent to persist both values.

In the absence of a mandated secret store, the ...[truncated 921 chars]
Remediation: View remediation
Remediation Suggestions

Require storage in the host platform's dedicated secret manager or encrypted credential vault.

Explicitly prohibit storage in project files, ordinary Agent memory, prompts, transcripts, logs, environment dumps, and source control.

Apply least-privilege file and process access controls to any unavoidable local credential material.

Redact the API key from tool responses, exceptions, telemetry, and diagnostic output.

Define credential expiration, rotation, revocation, and deletion procedures.

Issue narrowly scoped credentials that can access only the five declared airdrop tools.

Use separate registrations for separate users or security domains rather than sharing a single persisted identity.

Revise the “No File Persistence” statement to accurately distinguish secure credential storage from user-data storage.

T09 · Insecure Skill Coding Practices

Note

Location: README.md:59
Finding: Misleading Authentication and Data-Persistence Documentation
Content: View full analysis
Vulnerability Details

File Location: README.md:59-61
Vulnerability Type: Inconsistent security and privacy documentation
Risk Level: Low

Vulnerable Code Snippet

markdown
**Repository**: [antalpha-com/antalpha-skills](https://github.com/antalpha-com/antalpha-skills) (`feat/airdrop-hunter` branch) **No plugins or API keys required.** All data is fetched from public APIs (DefiLlama).

The same claim appears in README-zh.md:63-65. It conflicts with the mandatory registration requirement in SKILL.md:27-29:

markdown
**First-run registration** (one time): call `antalpha-register` to obtain your `agent_id` and `api_key`. Persist both. Pass `agent_id` on every subsequent tool call. Without registration, tool calls will be rejected.

It also conflicts with the persistence statement in SKILL.md:239:

markdown
- **No File Persistence**: No user data is stored locally

Technical Analysis

The user-facing documentation states that no API keys are required, while the operational instructions require registration, issuance of an API key, and persistence of that key. The documentation also does not clearly disclose that user-submitted URLs are processed through an external MCP service.

This inconsistency does not itself execute malicious behavior, but it undermines informed consent and secure deployment. Users and administrators may approve or install the Skill under the mistaken assumptions that:

No authentication secret will be created or stored.

Only unauthenticated public APIs are contacted.

No stable identifier is used for remote requests.

No persistent security-sensitive state is required.

Administrators may consequently omit secret-storage controls or external-service privacy review.

Attack Path

A user or administrator reviews README.md and concludes that the Skill requires no API key.

The Skill is installed without provisioning an approved secret store or reviewing the MCP service's privacy ...[truncated 845 chars]
Remediation: View remediation
Remediation Suggestions

Replace “No plugins or API keys required” with an accurate statement that first-run MCP registration issues an API key.

Explain where and how the credential must be securely stored.

Disclose that tool requests are sent to https://mcp-skills.ai.antalpha.com/mcp.

State that user-provided URLs may be transmitted to that service for analysis.

Document the use and persistence of agent_id, including its correlation implications.

Align README.md, README-zh.md, ABOUT.md, and SKILL.md so they describe the same authentication and data-handling behavior.

Clarify whether “No File Persistence” excludes credentials stored in a platform secret manager.

Add retention, deletion, privacy, and credential-revocation documentation.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 81% confidence
Finding: The statement "No warnings detected. You can proceed with caution." can function as overconfident safety assurance in a high-risk phishing domain. In practice, absence of detected warnings is not proof of safety, and users may interpret this as endorsement to connect a wallet, reducing their skepticism and increasing exposure to scams or malicious contracts.
Content: Scanner excerpt · README.md (reported line 276)May include surrounding context.
md
No warnings detected. You can proceed with caution.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill advertises scam detection, link verification, grading, and guided decision support, but the finding indicates the underlying implementation may not actually perform those safety-critical functions. In a Web3 context, users may rely on false assurances before visiting links or connecting wallets, which can directly enable phishing, loss of funds, or unsafe decisions.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The automation rules instruct the agent to auto-execute tools on generic inputs like any URL or a lone project name, without requiring confirmation or validating context. This can trigger external MCP calls on attacker-supplied content, amplify prompt-injection opportunities through remote tool output, and create trust in automated scam verdicts for high-risk wallet interactions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The shortcut commands are broad natural-language phrases like "daily report" and "check [项目名]", which can overlap with ordinary user conversation and cause the skill to trigger unintentionally. In a Web3 airdrop context, accidental activation is more concerning because the skill may steer users toward external links, project assessments, or scam-check workflows without the user explicitly intending to invoke this capability.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The workflow encourages users to verify URLs and then proceed toward wallet interaction and testnet participation, but the point-of-use guidance does not prominently warn about transaction signing, approval risk, fake faucets, or draining wallets. In a Web3 context, even legitimate-looking flows can expose users to phishing or unsafe approvals, so missing inline warnings materially increases user risk.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The quick-command phrases are broad natural-language triggers such as "daily report" and "check [project]" that can plausibly appear in ordinary conversation. In an agent environment, this can cause accidental invocation or misrouting, especially in contexts involving URLs, projects, or finance, leading the skill to engage unexpectedly with risky wallet-related guidance.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger description is broad enough to activate on common queries about links, projects, or opportunities, increasing the chance the skill runs in situations the user did not clearly intend. Over-broad activation is risky because it can route users into external tool calls and authoritative-seeming security guidance without sufficient confirmation or relevance.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Onboarding triggers like 'Help', 'Start', or 'What can you do' are highly generic and may cause the skill to take over unrelated conversations. While not directly a code-execution issue, this weakens user intent boundaries and can lead to confusing or unwanted tool-driven behavior.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: The skill explicitly mandates autonomous decision-making through 'Auto-Execute' behavior, reducing human-in-the-loop control for a sensitive Web3 workflow. In this context, autonomous actions on links and projects can mis-handle ambiguous input and increase the risk of unsafe guidance or unnecessary external data exposure.
Content: Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.
md
## 2. Automation Triggers (MANDATORY) | User Input Pattern | Auto-Execute Tool | Reason | |--------------------|-------------------|--------| | User provides a URL (with or without context) | `airdrop-scam-check` | Safety first. Verify before they click. | | User provides only a Project Name (no verb/intent) | `airdrop-check-project` | They want to know if it's worth their time. |

Behavior Manipulation

Medium

Category: Prompt Injection
Confidence: 75% confidence
Finding: Subtle instructions detected that may alter agent decision-making or introduce hidden biases.
Content: Scanner excerpt · references/grading-system.md (reported line 117)May include surrounding context.
md
## Prohibited Tokens (Hard Block) These projects have already completed their airdrops. **NEVER recommend them** as active opportunities: | Project | Token | Status | |---------|-------|--------|

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The example output fields and rendered content are written in Chinese across multiple sections, indicating the skill is designed to produce a specific language by default. The file does not offer any user language selection or explain a justified region-specific constraint, which matches the locale-policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: SQP-3 适用于所有文件类型。该文件整体以中文说明和中文交互示例为主，虽然顶部链接到英文版本，但在本文件内容中未说明技能是否允许用户选择输出语言，存在默认固定语言的自然语言策略风险。
Content: No source excerpt is available for this finding.

Overview

A.I.G

other

Vulnerability Details

Vulnerable Code Snippet

Technical Analysis

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code Snippet

Technical Analysis

Attack Path

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code Snippet

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Anti-Refusal Statement

Tp4

Vague Triggers

Vague Triggers

Missing User Warnings

Vague Triggers

Undeclared Tool Scope

Vague Triggers

Vague Triggers

Autonomous Decision Making

Behavior Manipulation

Natural-Language Policy Violations

Natural-Language Policy Violations