On-Chain Skill Audit

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:32 PM UTC
• Version: 0.1.1

Overview

The skill’s blockchain-audit purpose is coherent, but it relies on mutable external npm code for wallet-enabled Solana writes without pinned, reviewable dependencies.

Install only if you are comfortable running unpinned npm dependencies that can construct Solana transactions. Use a dedicated low-balance wallet, verify package versions and transaction details before signing, and treat public audit or vouch writes as permanent on-chain actions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: skill.md:42

Finding

Unpinned Third-Party Executable Dependencies

Content

View full analysis

Vulnerability Details

File Location: skill.md, lines 42-45 and 74-79
Vulnerability Type: Unpinned and unauditable third-party dependencies
Risk Level: Medium

The skill delegates security-sensitive blockchain and wallet operations to external npm packages without pinning exact versions, supplying a lockfile, recording package integrity hashes, or including the dependency source for review.

Affected code:

markdown

Package: [`@rocketlabs/skill-audit`](https://www.npmjs.com/package/@rocketlabs/skill-audit)

```javascript
const { checkSkill, registerSkill, auditSkill, vouchForSkill, hashSkill } = require('@rocketlabs/skill-audit');

text

The prerequisites also permit mutable future dependency releases:

```markdown
## Prerequisites
- `@iqlabs-official/solana-sdk` v0.1.1+ (CommonJS required)
- `@solana/web3.js` v1.x
- Solana wallet for writes
- IQ tokens for audit writes (token mint: `3uXACfojUrya7VH51jVC1DCHq3uzK4A7g469Q954LABS`)
- Buffer monkey-patch applied (handled automatically by the package)

Technical Analysis

The primary @rocketlabs/skill-audit package has no version constraint in the documented import, while @iqlabs-official/solana-sdk accepts any version from 0.1.1 onward and @solana/web3.js accepts any 1.x release. Because the project contains only skill.md, no lockfile or package integrity metadata is available to make dependency resolution reproducible.

A package imported through require() executes initialization code with the privileges of the hosting agent process. Consequently, a compromised, malicious, or unexpectedly changed permitted package release could run before any exported blockchain function is called. The documented automatic Buffer monkey-patch also indicates global runtime mutation, but its implementation is not present for audit.

This finding does not establish that the named packages are currently malicious. It identifies a supply-ch ...[truncated 1769 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every dependency to a reviewed, exact version rather than using unrestricted imports, minimum versions, caret ranges, or major-version ranges.
2. Add and commit a package lockfile containing registry-resolved integrity metadata.
3. Record the expected package versions and cryptographic integrity hashes directly in the installation documentation.
4. Audit or vendor the source of @rocketlabs/skill-audit and its transitive dependencies so that wallet and transaction behavior can be reviewed with the skill.
5. Replace automatic global Buffer monkey-patching with an explicit, narrowly scoped compatibility layer, or document and review the exact mutation performed.
6. Run dependency installation and execution in a restricted environment with minimal filesystem, network, and environment-variable access.
7. Keep wallet signing outside the dependency process when possible. Require explicit user confirmation and independently display the recipient, program ID, instructions, accounts, token amounts, and fees before signing.
8. Use a dedicated low-balance wallet with only the permissions and assets needed for the operation.
9. Add automated dependency scanning, provenance verification, and update review before accepting future releases.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.