Security audit

Etherlink Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is for legitimate Etherlink blockchain use, but it asks users to run an unpinned MCP package and provide wallet private keys for irreversible asset-moving actions without enough safeguards.

Review carefully before installing. Use read-only mode unless you truly need writes, avoid production private keys, prefer a low-value testnet wallet or external signer, pin and verify any MCP server package or source commit, and require explicit confirmation for every destination, amount, contract, network, and fee before signing.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: references/mcp-setup.md:11
Finding: Unpinned MCP Package Is Automatically Downloaded and Given Access to a Wallet Private Key
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/test-connection.sh:16
Finding: Untrusted RPC Response Is Evaluated as a Bash Arithmetic Expression
Content: View full analysis
Remediation: View remediation
&2 exit 1 fi ``` 2. Use a proper JSON parser such as `jq` rather than extracting JSON with `grep` and `cut`: ```bash BLOCK=$(printf '%s' "$RESPONSE" | jq -er '.result') ``` 3. Quote all ordinary variable expansions, including response parsing: ```bash printf '%s\n' "$MAINNET_RESULT" ``` 4. Harden network requests with failure handling and timeouts: ```bash curl --fail --silent --show-error --max-time 10 \ -X POST https://node.mainnet.etherlink.com \ -H 'Content-Type: application/json' \ --data '{"jsonrpc":"2.0","method":"eth_blockNumber","params":[],"id":1}' ``` 5. Verify the JSON-RPC response structure, request identifier, absence of an error object, and expected result type before consuming the value. 6. Use distinct variables for Mainnet and Shadownet results to reduce accidental state reuse. 7. Enable defensive shell settings after ensuring expected failures are handled: ```bash set -euo pipefail ``` ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill instructs users to configure an MCP server using a local command (bun run ...) and environment-based secrets, which implies shell/code-execution capability, but it does not declare any explicit tool scope such as permissions or allowed-tools. In an agent setting, undocumented execution capability increases the chance that a host will grant broader access than intended or that users will not understand the trust boundary around local code execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill tells users to place an EVM_PRIVATE_KEY in MCP server configuration without clearly warning that this is a highly sensitive credential that grants spending authority over blockchain assets. In this context, exposing or mishandling the key can directly lead to unauthorized transactions and permanent loss of funds, making the omission more dangerous than generic secret-handling issues.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The documentation advertises a transaction-sending operation without an accompanying warning that transfers are irreversible, may spend real funds, and require signing authority tied to a private key. In a blockchain skill, this omission materially raises the risk of accidental asset loss because users may treat the operation like a harmless query rather than a value-moving action.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/test-connection.sh (reported line 9)May include surrounding context.
sh
# Test Mainnet echo "=== Etherlink Mainnet (42793) ===" MAINNET_RESULT=$(curl -s -X POST https://node.mainnet.etherlink.com \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}') MAINNET_CHAIN=$(echo $MAINNET_RESULT | grep -o '"result":"[^"]*"' | cut -d'"' -f4)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/test-connection.sh (reported line 17)May include surrounding context.
sh
# Test Mainnet echo "=== Etherlink Mainnet (42793) ===" MAINNET_RESULT=$(curl -s -X POST https://node.mainnet.etherlink.com \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}') MAINNET_CHAIN=$(echo $MAINNET_RESULT | grep -o '"result":"[^"]*"' | cut -d'"' -f4)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/test-connection.sh (reported line 31)May include surrounding context.
sh
# Test Shadownet echo "=== Etherlink Shadownet (127823) ===" SHADOWNET_RESULT=$(curl -s -X POST https://node.shadownet.etherlink.com \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}') SHADOWNET_CHAIN=$(echo $SHADOWNET_RESULT | grep -o '"result":"[^"]*"' | cut -d'"' -f4)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/test-connection.sh (reported line 39)May include surrounding context.
sh
# Test Shadownet echo "=== Etherlink Shadownet (127823) ===" SHADOWNET_RESULT=$(curl -s -X POST https://node.shadownet.etherlink.com \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","method":"eth_chainId","params":[],"id":1}') SHADOWNET_CHAIN=$(echo $SHADOWNET_RESULT | grep -o '"result":"[^"]*"' | cut -d'"' -f4)

Static analysis

No suspicious patterns detected.