Hodl Dance Skill

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:49 AM UTC
• Version: 1.3.1

Overview

This skill appears purpose-built for HODL.DANCE trading, but it can spend real wallet funds and upload local files with weak safeguards.

Review before installing. Use a dedicated low-value wallet, pin the exact package version, avoid unpinned npx execution, run only read and quote commands unless you explicitly intend to spend funds, and do not let an agent choose logo file paths or trade amounts without strict limits and human approval.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: src/commands/create-token.js:68

Finding

Arbitrary Local File Upload Through Unvalidated Logo Path

Content

View full analysis

{ const wallet = getWallet(); const provider = wallet.provider; // 1. Upload metadata + logo const form = new FormData(); form.append('name', name); form.append('symbol', symbol); form.append('description', description); form.append('website', website); form.append('twitter', twitter); form.append('telegram', telegram); form.append('creator', wallet.address); form.append('category', category); form.append('logo', fs.createReadStream(resolvedLogo), { filename: path.basename(resolvedLogo), }); const uploadRes = await fetch(`${API_BASE}/token/create`, { method: 'POST', body: form, headers: form.getHeaders(), }); ``` ### Technical Analysis The documentation states that `--logo` must identify a PNG, JPEG, or WEBP image no larger than 5 MB. The implementation only verifies that the resolved path exists. It does not verify that the path is a regular file, enforce a size limit, inspect the file signature, restrict MIME types, or reject symbolic links and special files. Any accessible local path can consequently be opened with `fs.createReadStream()` and transmitted to `https://hodl.dance/api/token/create`. Although uploading a logo is necessary for token creation, unrestricted access to arbitrary local files exceeds the minimum filesystem privilege required by that functionality. This issue becomes exploitable when an attacker can influence command arguments, such as through an agent prompt, automation configuration, copied command, or untrusted workflow input. ### Attack Path 1. An attacker persuades an agent or us ...[truncated 1203 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: src/commands/buy-token.js:43

Finding

Buy and Sell Transactions Lack Enforceable Slippage Protection

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: src/commands/create-token.js:54

Finding

Documented Token-Creation Constraints Are Not Enforced

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (20)

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

form-data is a production dependency, and the cited CRLF injection issue can be dangerous when multipart field names or filenames are attacker-controlled. This can enable malformed request smuggling into downstream parsers, header injection in multipart bodies, or unexpected server-side behavior when the skill uploads user-influenced content to external services.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: nanoid==3.3.12 — 2 advisory(ies): CVE-2026-67214 (nanoid: non-secure generators can loop indefinitely with negative size); CVE-2026-67213 (nanoid: custom generators can loop indefinitely when size is zero)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: postcss==8.5.15 — 2 advisory(ies): CVE-2026-69153 (PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappi); CVE-2026-73646 (PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) l)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: vite==8.0.14 — 2 advisory(ies): CVE-2026-53571 (vite: `server.fs.deny` bypass on Windows alternate paths); CVE-2026-53632 (launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.17.1 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

ws is a production dependency pulled in through ethers, and the cited advisories include memory disclosure and memory exhaustion conditions affecting WebSocket handling. If the skill connects to untrusted or attacker-influenced WebSocket endpoints, an attacker could potentially trigger denial of service or leak process memory contents through malformed frames/fragments.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 87% confidence

Finding

The package includes form-data 4.0.5, which is flagged with a CRLF injection advisory. If the skill constructs multipart requests using attacker-controlled field names or filenames, an attacker may inject crafted headers or manipulate request structure, which is particularly concerning for an agent skill that may broker external HTTP/API interactions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README recommends running the skill via npx @hodl-dance/skill without pinning a specific version. That causes users and agents to fetch and execute whatever package version is current at runtime, creating a supply-chain risk where a compromised publisher account or malicious update could lead to arbitrary code execution, especially dangerous here because the tool is designed to use HODL_PRIVATE_KEY and perform on-chain transactions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README documents real buy-token, sell-token, and create-token commands and instructs users to export a private key, but it does not prominently warn that these actions are irreversible on-chain transactions with direct financial risk. In an agent-oriented trading skill, missing safety warnings materially increases the chance of accidental execution, loss of funds, or autonomous misuse by operators who assume examples are safe to run.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill instructs users to run the package via npx @hodl-dance/skill without pinning an exact version, which makes execution dependent on whatever package version is current at install time. Because this skill handles private keys and can submit real on-chain transactions, a compromised publisher account, malicious update, or dependency hijack could lead to credential theft or unauthorized trading.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documented commands buy-token, sell-token, and create-token send real blockchain transactions, but the skill does not present a clear, explicit warning that these actions are irreversible and can cause immediate financial loss through slippage, scams, wrong addresses, or malicious token behavior. In an agent context, this is especially risky because users may treat the skill as informational while it is actually capable of spending funds and approving token transfers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code sends the token name, symbol, description, social links, creator wallet address, and logo file to https://hodl.dance/api via HTTP POST. While the script's purpose implies token creation, there is no runtime confirmation, print/log disclosure, or explicit warning in the file that local file contents and metadata will be transmitted off-system.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: @vitest/mocker==4.1.7 — 1 advisory(ies): CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: vitest==4.1.7 — 1 advisory(ies): CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Low

• Category: Supply Chain
• Confidence: 60% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency uses a caret range, allowing newer minor/patch releases to be installed than the exact version reviewed. This creates supply-chain drift and can introduce unreviewed behavior or newly published malicious or breaking updates into the skill environment.

Content

Scanner excerpt · package.json (reported line 21)May include surrounding context.

json

"author": "HODL.DANCE",
  "license": "MIT",
  "dependencies": {
    "ethers": "^6.13.0",
    "form-data": "^4.0.5",
    "node-fetch": "^2.7.0"
  },

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The form-data dependency is not pinned exactly, which is especially risky because this package also has a known advisory in the supplied findings. Version ranges increase the chance of pulling unexpected releases and make incident response and reproducibility harder.

Content

Scanner excerpt · package.json (reported line 22)May include surrounding context.

json

"license": "MIT",
  "dependencies": {
    "ethers": "^6.13.0",
    "form-data": "^4.0.5",
    "node-fetch": "^2.7.0"
  },
  "engines": {

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

Using a caret range for node-fetch permits dependency drift across installations. While common in development, it weakens build reproducibility and can expose the skill to unexpected package changes or transitive supply-chain compromise.

Content

Scanner excerpt · package.json (reported line 23)May include surrounding context.

json

"dependencies": {
    "ethers": "^6.13.0",
    "form-data": "^4.0.5",
    "node-fetch": "^2.7.0"
  },
  "engines": {
    "node": ">=18.0.0"

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The devDependency vitest is specified with a caret range, so test or CI environments may resolve to newer releases than intended. Although this is less exposed than a runtime dependency, it still presents supply-chain and reproducibility risk, especially in automated pipelines.

Content

Scanner excerpt · package.json (reported line 41)May include surrounding context.

json

"version": "node -e \"console.log(require('./package.json').version)\""
  },
  "devDependencies": {
    "vitest": "^4.1.7"
  }
}

Known Vulnerable Dependency: vitest==4.1.7 — 1 advisory(ies): CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Low

• Category: Supply Chain
• Confidence: 80% confidence

Finding

Vitest 4.1.7 is reported as affected by a path traversal/arbitrary file read issue through mocking features. Because this is a devDependency, the primary exposure is in developer or CI environments rather than production runtime, but it can still matter if untrusted tests, fixtures, or PR workflows are executed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The comment "znajdź nowy token" forces a non-English phrase without any user opt-in or documented locale context. This is a minor natural-language policy inconsistency because the rest of the skill is written in English and no regional justification is provided.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This code performs an HTTP/API request using the user-provided address, which is a network operation covered by the missing-warnings rule for code files. There is no visible confirmation prompt, log/print disclosure, or explanatory comment/docstring in this file indicating that the address will be sent to a remote API.

Content

No source excerpt is available for this finding.