Security audit

zscore

Security checks across malware telemetry and agentic risk

Overview

This skill does what it says, but it can spend wallet funds and change public on-chain agent records without built-in confirmation safeguards.

Install only if you intentionally want an agent to manage Zeru registry entries. Use a dedicated low-balance or testnet wallet, avoid reusing a primary wallet key, review every write command before running it, and treat fetched agent metadata as untrusted remote content.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill declares no explicit permissions while clearly requiring sensitive environment access (`PRIVATE_KEY`) and network access to blockchain RPCs and external APIs. This undermines informed consent and review because users may enable a skill without realizing it can transmit data externally and sign on-chain transactions.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented behavior focuses on registry operations, but the skill also appears to create/update off-chain registration documents, query discovery/reputation services, and fetch arbitrary tokenURI/agentURI JSON over HTTP(S). This expands the trust boundary significantly: metadata and potentially sensitive agent information can be sent to or retrieved from third-party services not clearly disclosed in the primary description.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The setup instructions tell users to place a raw funded private key directly into configuration without a strong warning about irreversible fund loss if the key is exposed. Because this skill performs on-chain writes, compromise of that key could let an attacker drain funds or impersonate the owner for registry operations.

Missing User Warnings

Low

Confidence: 81% confidence
Finding: The function automatically fetches a URL taken from on-chain metadata (`agentURI`) whenever it begins with `http`, with no disclosure, allowlisting, or network-boundary controls. This can trigger unintended outbound requests to attacker-controlled infrastructure, exposing server/IP metadata, enabling SSRF-style access to internal resources in some deployments, or causing privacy and reliability issues when merely reading agent data.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: `getSigner()` loads `PRIVATE_KEY` and is used by write commands that submit on-chain transactions, but the CLI provides no explicit confirmation or strong pre-execution warning before signing and broadcasting state-changing actions. In an agent-skill context, this increases the chance that a user or higher-level agent triggers irreversible blockchain actions with real funds and credentials without clear consent boundaries.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The `unset-wallet` command performs a destructive on-chain action immediately after parsing input, with no interactive confirmation, dry-run, or ownership/context check shown in this file. In a skill intended for agent use, this makes accidental or prompt-induced wallet removal more likely, and the change may be difficult or costly to recover from depending on contract semantics.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.