T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/src/cli.ts:1686- Finding
Element Authorization Token Disclosed Through Standard Output
- Content
View full analysis
- Remediation
View remediation
Security audit
Element NFT Drops
Security checks for vulnerabilities and agentic risk
Overview
This skill is purpose-built for Element NFT drop management, but it uses wallet credentials and has raw commands that can make live remote or blockchain changes without an enforced confirmation gate.
Install only if you are comfortable using a dedicated low-risk wallet and reviewing every preview before execution. Avoid invoking the advanced utility commands directly, treat terminal output/logs as sensitive, and prefer a locked dependency install rather than on-demand unpinned npx execution.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/src/config.ts:6- Finding
Recoverable Shared GraphQL Credentials Embedded in Source Code
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (47)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
If the underlying implementation performs low-level auth and direct collection-edit operations without the required user-facing preview/confirmation controls, the skill could mutate remote state unexpectedly while operating with a sensitive wallet credential. The danger is increased by the mismatch between reassuring user-facing rules and potentially less constrained backend behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the underlying implementation performs low-level auth and direct collection-edit operations without the required user-facing preview/confirmation controls, the skill could mutate remote state unexpectedly while operating with a sensitive wallet credential. The danger is increased by the mismatch between reassuring user-facing rules and potentially less constrained backend behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
If the underlying implementation performs low-level auth and direct collection-edit operations without the required user-facing preview/confirmation controls, the skill could mutate remote state unexpectedly while operating with a sensitive wallet credential. The danger is increased by the mismatch between reassuring user-facing rules and potentially less constrained backend behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the underlying implementation performs low-level auth and direct collection-edit operations without the required user-facing preview/confirmation controls, the skill could mutate remote state unexpectedly while operating with a sensitive wallet credential. The danger is increased by the mismatch between reassuring user-facing rules and potentially less constrained backend behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
If the underlying implementation performs low-level auth and direct collection-edit operations without the required user-facing preview/confirmation controls, the skill could mutate remote state unexpectedly while operating with a sensitive wallet credential. The danger is increased by the mismatch between reassuring user-facing rules and potentially less constrained backend behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
If the underlying implementation performs low-level auth and direct collection-edit operations without the required user-facing preview/confirmation controls, the skill could mutate remote state unexpectedly while operating with a sensitive wallet credential. The danger is increased by the mismatch between reassuring user-facing rules and potentially less constrained backend behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
If the underlying implementation performs low-level auth and direct collection-edit operations without the required user-facing preview/confirmation controls, the skill could mutate remote state unexpectedly while operating with a sensitive wallet credential. The danger is increased by the mismatch between reassuring user-facing rules and potentially less constrained backend behavior.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The CLI exposes multiple state-changing utility commands such as post-settings, post-design, upload-prereveal, upload-design, post-create-collection, and create-token that execute immediately without the explicit preview/confirmation gate required by the skill contract. In this skill context, those commands can mutate remote drop configuration, upload media, or trigger blockchain-related actions, so an agent or caller that invokes the raw CLI directly can bypass the safety invariant and cause unintended irreversible changes.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This workflow performs a state-changing blockchain action immediately by calling
sendTransactionafter obtaining the encoded transaction, with no built-in preview-only mode or confirmation gate in this function. In the skill context, the metadata explicitly requires every state-changing flow to show an execution preview first and wait for confirmation, so this code path can cause unintended token creation if invoked by an agent or tool chain without an external safeguard.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill explicitly requires a private-key environment variable and describes networked API/transaction behavior, but it does not declare any tool scope such as allowed tools or permissions. That omission weakens reviewability and least-privilege controls, making it harder to constrain environment and network access for a highly sensitive workflow.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md General: - Use `chainName`; do not ask users for chain IDs. - Use `slug` as the main identifier for existing drops. - Resolve backend identifiers internally. - Do not ask for hidden backend IDs when `slug` is enough.
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The documentation states that the script may derive a wallet address from
ELEMENT_WALLET_PRIVATE_KEYifwalletAddressis omitted, but it does not prominently warn users that a private-key-backed identity may be used implicitly. In the context of a blockchain/NFT management skill, this is security-relevant because users may trigger wallet-associated operations under an unintended identity and underestimate the sensitivity of the environment variable.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The documentation instructs users to run
npx tsxwithout pinning an exact package version, which can cause code to be fetched and executed from the registry at invocation time. In a skill that interacts with blockchain assets and may rely on wallet-related environment variables, this increases supply-chain risk because a compromised or unexpectedly updated package could execute arbitrary code in the user's environment.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
The documentation instructs users to run
npx tsxwithout pinning an exact package version, which can cause execution of whatever version npm resolves at runtime. If a malicious or compromised package version is published or dependency resolution is influenced, this can lead to unintended code execution on the operator's machine.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file describes a state-changing
update-dropcommand that can automatically continue into a publish flow when live settings or prereveal data are changed, yet the execute section presents the live command without an explicit hard stop requiring prior preview review and user confirmation. In a skill that modifies NFT drop configuration and may trigger onchain-affecting publication, this omission materially increases the chance of unintended live changes, financial loss, or irreversible release of incorrect metadata or sale settings.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This code reads a local image file, packages its bytes into multipart form data, and sends it via HTTP POST to
input.url. Although the code logs failed responses, there is no confirmation prompt or user-facing disclosure in this file that local file contents will be uploaded to an external service.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The error logger records the full request URL and a recursively summarized response body to stderr, with only length truncation and no redaction of secrets or sensitive business data. In a skill that handles NFT drop configuration, external APIs may return presigned URLs, auth-related metadata, wallet-linked information, or unpublished drop details, which could then be exposed in logs accessible to operators or downstream log systems.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The postJson helper accepts arbitrary input and sends it over the network via fetch after JSON serialization. In this file there is no visible warning, confirmation, or explanatory comment indicating that caller-provided data will be transmitted externally, which matters for a reusable HTTP utility that may handle sensitive user or system data.
- Content