Flap Skills

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:26 AM UTC
• Version: 1.8.0

Overview

This skill openly automates real BSC token trading and volume generation, but it grants broad ongoing wallet authority without adequate caps, revocation, or per-action user control.

Review carefully before installing. Use only a wallet funded with amounts you can afford to lose, avoid unlimited approvals, require explicit caps and confirmations, revoke token allowances and worker permissions after use, and do not leave generated worker key files in shared, synced, or repository directories.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:235

Finding

Financial Operations Are Designed to Bypass Per-Transaction User Confirmation

Content

View full analysis

\ PRIVATE_KEYS_FILE= \ TOKEN_CA= \ COLLECT_TO_ADDRESS= \ USDT_MIN= \ USDT_MAX= \ node scripts/mm-bot.js ``` The Skill explicitly states that worker gas replenishment must occur without further owner confirmation. ### Technical Analysis The Skill converts a broad natural-language market-making request into a sequence of irreversible financial actions without requiring confirmation at each security boundary. Those actions include: - Sending BNB to as many as 20 newly generated wallets. - Granting a third-party contract effectively unlimited USDT spending authority. - Destroying 50,000 tokens through the documented `setAllowedCallers` workflow. - Starting an indefinite transaction loop with no duration, loss, or total-spend limit. - Sending additional BNB whenever the bot reports a possible gas shortage. This is an instruction-level safety violation rather than an isolated implementation error. The Skill explicitly tells the Agent not to request approval for later transfers and characterizes those transfers as im ...[truncated 1639 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/mm-generate-workers.js:33

Finding

Worker Wallet Private Keys Are Stored Unencrypted in Predictable Files

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:183

Finding

Unlimited USDT Allowance and Persistent Worker Authorization Enable Post-Session Spending

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: references/contract-abi.md:57

Finding

Token Sale Operations Provide No Minimum-Output or Deadline Protection

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (56)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README explicitly describes autonomous fund transfers, USDT approvals, worker authorization, and gas top-ups 'without owner approval' in an ongoing loop. In a skill with access to a private key, this materially increases the chance of unauthorized or poorly understood financial loss, especially because the README normalizes unattended spending behavior rather than requiring explicit per-action consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Using external upload flows and local scripts while presenting the skill as a simple BNB Chain MCP capability obscures both data-flow and custody risks. In this context, the discrepancy makes the skill more dangerous because the user is being asked to trust hidden off-chain operations alongside on-chain approvals.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

Using external upload flows and local scripts while presenting the skill as a simple BNB Chain MCP capability obscures both data-flow and custody risks. In this context, the discrepancy makes the skill more dangerous because the user is being asked to trust hidden off-chain operations alongside on-chain approvals.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Using external upload flows and local scripts while presenting the skill as a simple BNB Chain MCP capability obscures both data-flow and custody risks. In this context, the discrepancy makes the skill more dangerous because the user is being asked to trust hidden off-chain operations alongside on-chain approvals.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Using external upload flows and local scripts while presenting the skill as a simple BNB Chain MCP capability obscures both data-flow and custody risks. In this context, the discrepancy makes the skill more dangerous because the user is being asked to trust hidden off-chain operations alongside on-chain approvals.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Using external upload flows and local scripts while presenting the skill as a simple BNB Chain MCP capability obscures both data-flow and custody risks. In this context, the discrepancy makes the skill more dangerous because the user is being asked to trust hidden off-chain operations alongside on-chain approvals.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Using external upload flows and local scripts while presenting the skill as a simple BNB Chain MCP capability obscures both data-flow and custody risks. In this context, the discrepancy makes the skill more dangerous because the user is being asked to trust hidden off-chain operations alongside on-chain approvals.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill authorizes autonomous BNB transfers to worker wallets and ongoing gas top-ups without requiring fresh user confirmation. In a blockchain setting, this is dangerous because it enables repeated value transfers from the user's wallet under a broad standing instruction, making abuse, runaway spending, or covert draining much easier.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly instructs the agent to autonomously transfer funds and continue topping up worker wallets without further user approval. This removes the normal consent boundary around financial transactions and materially increases the chance of unauthorized spending, abuse by a compromised script, or silent depletion of user assets.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

md

合约 approve USDT（授权合约可划转 funder 的 USDT）、setAllowedCallers 登记 worker** → 在技能目录启动 `mm-bot.js`（**由 worker 调用合约** buyForCaller/sellForCaller 买卖，不是 MCP 直接买卖）。**做市只有启动

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.

md

合约 approve USDT（授权合约可划转 funder 的 USDT）、setAllowedCallers 登记 worker** → 在技能目录启动 `mm-bot.js`（**由 worker 调用合约** buyForCaller/sellForCaller 买卖，不是 MCP 直接买卖）。**做市只有启动

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 222)May include surrounding context.

md

合约 approve USDT（授权合约可划转 funder 的 USDT）、setAllowedCallers 登记 worker** → 在技能目录启动 `mm-bot.js`（**由 worker 调用合约** buyForCaller/sellForCaller 买卖，不是 MCP 直接买卖）。**做市只有启动

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 230)May include surrounding context.

md

合约 approve USDT（授权合约可划转 funder 的 USDT）、setAllowedCallers 登记 worker** → 在技能目录启动 `mm-bot.js`（**由 worker 调用合约** buyForCaller/sellForCaller 买卖，不是 MCP 直接买卖）。**做市只有启动

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 250)May include surrounding context.

md

合约 approve USDT（授权合约可划转 funder 的 USDT）、setAllowedCallers 登记 worker** → 在技能目录启动 `mm-bot.js`（**由 worker 调用合约** buyForCaller/sellForCaller 买卖，不是 MCP 直接买卖）。**做市只有启动

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 273)May include surrounding context.

md

合约 approve USDT（授权合约可划转 funder 的 USDT）、setAllowedCallers 登记 worker** → 在技能目录启动 `mm-bot.js`（**由 worker 调用合约** buyForCaller/sellForCaller 买卖，不是 MCP 直接买卖）。**做市只有启动

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The narrative tells the agent to autonomously fund worker wallets and grant the contract unlimited access to the funder's USDT, all from a single natural-language request. This is a semantic instruction to expose user-controlled financial resources through broad delegated access, conveyed in operational prose rather than obvious exfiltration keywords.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation recommends effectively unlimited USDT approval to the contract without a prominent warning or strict necessity proof. Unlimited ERC-20 allowance is one of the highest-risk wallet actions because if the contract, spender path, or agent behavior is compromised, the approved funds can be drained without further consent.

Content

No source excerpt is available for this finding.

Ssd 4

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The multi-step narrative encourages the agent to escalate from a natural-language request into persistent wallet automation involving approvals, asset transfers, caller registration, and background bot execution. In this context, the skill is more dangerous because it operates on real blockchain funds, and the described persistence and autonomy reduce opportunities for the user to notice or halt abusive behavior before losses occur.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The lockfile pins axios 1.13.6, and the supplied advisory set includes multiple high-risk issues such as SSRF-related proxy bypass and prototype-pollution-adjacent request manipulation. In this skill, HTTP client behavior matters because the package set is used alongside blockchain tooling and external network interactions, so a compromised or attacker-influenced request path could expose credentials, redirect traffic, or trigger unintended outbound requests.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 84% confidence

Finding

form-data 4.0.5 is flagged for CRLF injection via unescaped multipart field names/filenames. If any part names or filenames can be influenced by untrusted input, an attacker may be able to smuggle or alter multipart content and potentially abuse upstream HTTP parsers or intermediary services.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.18.3 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

ws 8.18.3 is reported with memory disclosure and memory exhaustion issues. In a blockchain-related skill, WebSocket use is common for provider/event connections, so exposure to a malicious or compromised endpoint could lead to denial of service or unintended data exposure in long-running agent processes.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The package allows installation of an axios version reported with multiple advisories, including SSRF-related proxy bypass and prototype-pollution-based MITM or credential theft issues. In a skill that uploads metadata and likely performs remote HTTP interactions for token operations, these flaws could expose credentials, redirect requests, or permit attacker-controlled network access paths.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The resolved form-data version is flagged for CRLF injection in multipart field names and filenames, which is relevant because this package explicitly uploads token metadata. If attacker-controlled metadata fields are incorporated into multipart requests, the bug could lead to request smuggling, header injection, or malformed uploads to downstream services.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

These sections document third-party-funded trading flows where one party supplies funds and another address executes buy/sell activity, but they lack clear warnings about custody boundaries, authorization risk, loss scenarios, and who ultimately receives proceeds. In context, this structure is especially dangerous because it enables opaque fund flows and operational patterns consistent with wash trading or misuse of delegated approvals.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The document openly promotes '刷量' behavior, i.e., artificial volume generation, which is deceptive market manipulation rather than ordinary token management. Given the skill metadata also advertises automated 5-buy/5-sell loops and fallback trading behavior, the context substantially increases danger by operationalizing manipulative trading patterns for real on-chain execution.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/mm-bot.js:123