T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:89- Finding
Transaction verification can miss dangerous token approvals
- Content
View full analysis
- Remediation
View remediation
Security audit
Onchain Verify Transaction
Security checks for vulnerabilities and agentic risk
Overview
This skill is not malicious, but it should be reviewed because it is a financial transaction safety gate with an under-specified approval check that could miss dangerous permissions.
Review this skill before relying on it for real transactions. It is suitable as a disclosed Tenderly simulation helper, but users should require stronger approval and authorization-state checks before treating a transaction as safe, especially for token approvals, Permit/Permit2, NFT operator approvals, multicalls, and proxy-mediated calls.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 85% confidence
- Finding
Skipping verification on unsupported chains creates a fail-open path in a skill whose stated purpose is to act as a pre-execution safety gate. Even with a warning and confirmation requirement, callers or users may normalize bypassing the check, allowing malicious or malformed calldata on unsupported networks to avoid the intended simulation-based review.
- Content
md | Arbitrum One | `42161` | `https://arbitrum.gateway.tenderly.co` | | Polygon | `137` | `https://polygon.gateway.tenderly.co` | If the `chainId` is not in this list, skip verification, warn the user that the chain is unsupported, and require explicit confirmation before proceeding. > Add new entries as additional chains become supported.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash TENDERLY_URL="https://base.gateway.tenderly.co" curl -sS -X POST "$TENDERLY_URL" \ -H "Content-Type: application/json" \ -H "X-Access-Key: $TENDERLY_NODE_ACCESS_KEY" \ -d '{
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md | `TENDERLY_NODE_ACCESS_KEY` not set | Warn that verification is unavailable; require explicit user confirmation before proceeding | | `chainId` not in supported list | Warn that chain is unsupported for verification; require explicit user confirmation | | Tenderly returns an error | Surface the error message; treat as verification failure and require confirmation | | Rate limit hit (HTTP 429) | Warn the user; do not retry automatically; require confirmation to proceed without verification | | Verification passes all checks | Return control to the calling skill to proceed with execution | | Verification fails a check | Halt; surface the specific discrepancy; do not execute |