Security audit

zeko

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for Zeko blockchain workflows, but it guides agents toward unattended transaction execution with private keys and unpinned CLI downloads without enough explicit safeguards.

Review this skill carefully before installing. Use isolated test keys and least-privilege tokens, avoid pasting secrets into shared shells or logs, pin or preinstall the CLI packages yourself, and require explicit confirmation before any command that signs or submits a transaction.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This reference explicitly promotes unattended bridge execution and faucet automation using MINA_PRIVATE_KEY and GITHUB_TOKEN, but it does not prominently warn that commands will sign transactions, submit actions to external networks, and consume sensitive credentials. In an agent context, that omission increases the risk of accidental fund movement, credential exposure through logs or shell history, and unsafe execution by users who may treat the commands as routine read-only automation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The document instructs users to execute npx -y @zeko-labs/bridge-cli without pinning an exact package version. That causes code to be fetched and executed at runtime from the registry, so a compromised publisher account, dependency hijack, or unexpected package update could result in arbitrary code execution in the agent environment, especially dangerous here because the same workflow uses MINA_PRIVATE_KEY for signing.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The doctor example also uses npx -y @zeko-labs/bridge-cli without version pinning, which still performs remote code retrieval and execution. Even though doctor sounds diagnostic, it runs in the same environment and could access credentials, local files, or bridge state if the fetched package is malicious or tampered with.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/40-endpoints-and-curl.md (reported line 1)May include surrounding context.
md
# Endpoints And Curl Use this file when you need exact public endpoints, Bridge SDK config values, or directly runnable queries.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The document shows an inline script that directly reads a private key from the MINA_PRIVATE_KEY environment variable and uses it in an ad hoc terminal workflow without any explicit warning about secret handling, shell history, process inspection, or safer key-management practices. In a builder/automation skill, this can normalize unsafe credential use and increase the chance that users expose signing keys in insecure local or CI environments.
Content: No source excerpt is available for this finding.