Security audit

web123

Security checks for vulnerabilities and agentic risk

Overview

This is a local Web3 skill catalog, but it broadly steers ordinary requests toward trading, wallet, payment, and signing skill installs without enough risk warnings or confirmation boundaries.

Review this before installing because it is a gateway to other high-risk Web3 skills. Do not batch-install the recommended packs blindly; inspect each downstream skill, use dedicated low-balance wallets and least-privilege exchange API keys, and require explicit confirmation before any trade, wallet signature, transfer, approval, or payment.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The README encourages activation through very broad natural-language requests such as trading, wallet checks, and analysis queries without requiring an explicit skill name or confirmation step. In an agent ecosystem, this can cause unintended routing or automatic installation/recommendation behavior from ordinary conversation, which is risky because many referenced skills relate to financial actions and wallet operations.

Vague Triggers

Low

Confidence: 89% confidence
Finding: The phrase 'What Web3 skills are available' is close to normal conversational wording and may trigger the skill during generic discussion rather than intentional use. While the direct impact is lower than transaction-oriented phrases, it still expands the attack surface for prompt-routing confusion and unintended disclosure of capability menus or install suggestions.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README promotes skills for exchange trading, token trading, wallet balance checks, contract scanning, and wallet connection/payment-related actions without prominent warnings about financial risk, privacy exposure, exchange account consequences, or wallet authorization danger. Because this navigator is explicitly aimed at Web3 newcomers, users may be steered into high-risk capabilities without understanding that downstream skills can expose funds, sensitive addresses, or account credentials.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger conditions are broad enough to activate on many ordinary Web3-related queries such as trading, wallet balance, beginner help, or category browsing. This can cause unintended invocation of the navigator, which may steer users toward installation actions or recommendations when they did not explicitly request this skill, increasing the chance of prompt hijacking-by-overlap, user confusion, and unwanted tool exposure.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The manifest description includes an extensive list of generic trigger phrases spanning broad Web3 topics, which makes invocation ambiguous at the metadata level. In systems that use descriptions for routing, this can over-match unrelated conversations and cause this skill to intercept requests better handled by more specific skills, leading to unintended recommendations and install guidance.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The examples include very broad natural-language phrases such as '帮我…' and '我想…' for skills that can trade assets or initiate other sensitive Web3 actions. In a recommendation/invocation system, ambiguous trigger phrasing increases the risk of accidental skill matching and unintended routing into high-impact capabilities, especially because many listed skills overlap semantically.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The manifest broadly describes categories, scenarios, and examples but does not specify strict trigger boundaries, exclusions, or disambiguation logic. Because this catalog covers trading, investing, wallet inspection, payment, and signing, ambiguous matching across ordinary conversation could activate the wrong skill and lead users toward sensitive financial workflows unintentionally.

Missing User Warnings

High

Confidence: 95% confidence
Finding: Transactional skills here cover token swaps, leveraged derivatives, CEX trading, prediction-market betting, and investment link generation, yet the descriptions and examples do not prominently warn users about financial loss, liquidation, jurisdictional restrictions, or execution risk. In a skill catalog meant to recommend installation and usage, omission of such warnings materially increases the chance users will engage with high-risk actions without informed consent.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The wallet connection/signing skill explicitly supports connecting user wallets and requesting signatures or transfers, but the catalog text does not warn that signatures can authorize token approvals, off-chain commitments, or direct asset movements. In Web3 contexts, users often cannot distinguish harmless messages from dangerous signing flows, so lack of warning is especially risky.

Static analysis

No suspicious patterns detected.