Security audit

nearai-verify

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed NEAR AI privacy and attestation helper whose local checks, network calls, and optional installs fit its stated purpose, with care needed around optional dependency and plugin installation.

Install this only if you want NEAR AI endpoint privacy checks. Treat Level 1 as informational, Level 2 as a point-in-time endpoint attestation, and Level 3 as dependent on the separately installed plugin. Review the plugin separately before installing it, and approve --install only if you are comfortable adding Python packages in the skill's private venv.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

subprocess module call

Medium

Category: Dangerous Code Execution
Content: print(" venv creation failed - is python3-venv installed?") return 1 print(f"Installing {' '.join(EXTRAS)}") r = subprocess.run([str(VENV / "bin" / "pip"), "install", "-q", *EXTRAS]) if r.returncode: print(" install failed - see pip output above") return 1
Confidence: 90% confidence
Finding: This executes a pip binary from a path derived from the environment-controlled VENV location. An attacker who can influence XDG_CACHE_HOME or pre-place a malicious executable at that path could cause arbitrary code execution when --install is run, and even without path hijacking this skill performs package installation and executes third-party installer code beyond its attestation purpose.

subprocess module call

Medium

Category: Dangerous Code Execution
Content: pass vp = venv_python() if vp: r = subprocess.run([str(vp), "-c", f"import {mod},sys;print(getattr({mod},'__version__','?'))"], capture_output=True, text=True) if r.returncode == 0: return True, f"{r.stdout.strip()} (skill venv)"
Confidence: 88% confidence
Finding: This launches a Python interpreter from an environment-derived venv path and executes inline code. Because the interpreter path comes from VENV/XDG_CACHE_HOME, a local attacker who can control that path or place a rogue binary there may obtain arbitrary code execution when capability probing runs; this is especially risky because the probe can occur during normal diagnostic use, not only explicit installation.

Tainted flow: 'VENV' from os.environ.get (line 35, credential/environment) → subprocess.run (code execution)

Medium

Category: Data Flow
Content: print(" venv creation failed - is python3-venv installed?") return 1 print(f"Installing {' '.join(EXTRAS)}") r = subprocess.run([str(VENV / "bin" / "pip"), "install", "-q", *EXTRAS]) if r.returncode: print(" install failed - see pip output above") return 1
Confidence: 92% confidence
Finding: Here the environment-derived VENV value directly determines which executable is run (`.../bin/pip`). If an attacker can influence the environment or filesystem state, they can redirect execution to a malicious binary or tamper with the venv contents, leading to arbitrary code execution during --install.

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill instructs the agent to run local Python scripts, inspect logs, access environment-backed provider credentials, make outbound network requests, and even perform installation steps that create a local virtual environment, yet it declares no permissions. This mismatch can cause the host platform or user to underestimate the skill's access and side effects, increasing the chance of unexpected file, network, shell, and environment interactions.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill's stated purpose is endpoint verification/attestation, but it also creates virtual environments and installs packages. Self-installation expands the attack surface significantly because package installation executes arbitrary setup/build hooks and introduces supply-chain risk, which is unnecessary for a verification-focused skill and more dangerous in agent contexts where users may not expect environment modification.

Context-Inappropriate Capability

Medium

Confidence: 87% confidence
Finding: The code executes package/environment management subprocesses as part of dependency probing, which is outside the narrow core task of attestation. Running another interpreter from a mutable venv path to inspect packages creates an unnecessary execution path that can be abused locally and makes a verification tool unexpectedly capable of running external code.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: The file and skill metadata position this capability as verification of TEE privacy and cryptographic attestation, but the implementation explicitly only reads local config, a public endpoint catalog, and local logs. In a security-verification skill, this mismatch is dangerous because users may rely on a claim-level check as if it were proof and disclose sensitive data under false assurance.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The '--served' mode reports which model answered recent turns by parsing local gateway logs, which are not cryptographically trustworthy and may be incomplete, tampered with, or simply reflect routing rather than verified execution. In the context of a privacy/TEE verification skill, presenting this as verification can mislead operators about where prompts were actually processed.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.insecure_tls_verification

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: test_attest.py:20

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: attest.py:204