T08 · Insecure Dependencies
Warning
- Location
SKILL.md:162- Finding
Unaudited Installation Commands and Source Code Retrieved from Mutable External Pages
- Content
View full analysis
- Remediation
View remediation
Security audit
GizmoLab Tools
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent Web3 helper, but it directs wallet-connected blockchain transactions and external code installation without enough safety scoping or user-confirmation guidance.
Review this skill carefully before installing. Use testnet/devnet first, never let an agent confirm wallet signatures or transactions without fresh human approval, verify every contract address and transaction detail, and inspect any copied installation command or component code before adding it to a project.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs users to connect a wallet, fill token parameters, and confirm transactions without an explicit safety warning that these are real on-chain operations that may incur fees, create assets permanently, or expose funds if performed on mainnet. In a blockchain-operation skill, omission of transaction-risk warnings materially increases the chance of accidental asset-impacting actions by users or an agent acting on their behalf.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Describing contract write interactions as a normal capability without clearly warning that write methods can transfer funds, grant approvals, modify ownership, or trigger irreversible state changes is dangerous. Because the skill encourages interaction with arbitrary smart contracts, the absence of a strong warning raises the risk of users or agents executing harmful transactions against malicious or misunderstood contracts.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Presenting swaps as a simple tool flow without warning about fund movement, slippage, route risk, MEV/price movement, and irreversibility can lead users to approve transactions that result in unexpected loss. In a wallet-connected swapping context, omitting those warnings is security-relevant because the tool directly facilitates asset-moving actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Listing cross-chain bridging and trading widgets without any accompanying caution understates the financial and operational risks of those components, including irreversible transfers, bridge failures, wrong-chain mistakes, and market losses. While this section is about UI components rather than immediate execution steps, it still encourages integration of high-risk financial functionality without safety guidance.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
Line L118 states the transaction decoder 'works offline - no network needed', which directly conflicts with the documented usage that requires opening https://tools.gizmolab.io in a browser at L048. This is an intent/documentation contradiction rather than a mere omission, because it explicitly describes a no-network property while the skill's actual operation depends on network access to a hosted web tool.
- Content
Static analysis
No suspicious patterns detected.