Arbitrum Dapp Skill

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:54 AM UTC
• Version: 1.1.0

Overview

This is a coherent Arbitrum development guide, but its installer and deployment examples should be used carefully because they involve remote scripts, an install-count ping, and blockchain transaction commands.

Prefer ClawHub install or clone-and-review over the remote bash one-liner. Set ARBITRUM_SKILL_NO_ANALYTICS=1 before running install.sh if you do not want the install-count ping. Use disposable local/test wallets, avoid pasting real private keys into shell history, and double-check RPC URLs and network names before any --broadcast or mainnet deployment command.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill includes shell-capable commands such as git clone, running a local script, and deployment commands, but it does not declare permissions for those capabilities. Undeclared execution capability reduces transparency and prevents proper sandboxing or user consent, which is risky because the referenced commands can fetch and run external code locally.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 84% confidence
• Finding: The skill is presented as documentation for Arbitrum dApp development, but it instructs cloning a remote repository and executing its run-dev-node.sh script, which introduces behavior beyond passive guidance. If installation also causes outbound analytics or other undeclared network activity, that mismatch can hide supply-chain or privacy risks because users are not adequately warned about code retrieval and external communication.

Context-Inappropriate Capability

Low

• Confidence: 94% confidence
• Finding: The installer performs outbound analytics unrelated to the core act of installing the skill. Even though the comments claim only a pageview is sent and opt-out exists, it still creates undisclosed network side effects and transmits installation telemetry to a third party during execution of a local setup script.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The document gives a strong rule to always pass an explicit URL to `http()` because omitting it may silently fail for custom chains, but a later viem example uses `http()` with no argument. This inconsistency can cause developers to copy a non-working or misconfigured transport pattern, leading to failed RPC calls, incorrect network assumptions, or accidental reliance on unintended defaults.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The quick-start instructs users to execute a remote script directly via curl-to-bash from GitHub without review, pinning, or integrity verification. In a developer skill context, this is dangerous because compromise of the repository, account, branch, or transit path could immediately lead to arbitrary local code execution on the user's machine.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The deployment examples show passing a raw private key directly on the command line (`--private-key 0x...`) without any warning about secure secret handling. Command-line secrets can be exposed through shell history, process listings, CI logs, screenshots, or copied documentation patterns, making accidental key compromise more likely for users following the guide.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The documentation embeds a raw private key directly in deployment and transaction commands, which normalizes unsafe credential handling and creates a real risk that users will reuse or accidentally expose sensitive keys. Even if this key is intended only for a local devnode, the file does not clearly label it as a disposable test key or warn readers never to use real funded accounts in this way.

External Transmission

Medium

• Category: Data Exfiltration

Content

# See: https://www.goatcounter.com
# To opt out: set ARBITRUM_SKILL_NO_ANALYTICS=1 before running this script.
if [ -z "${ARBITRUM_SKILL_NO_ANALYTICS:-}" ]; then
  curl -s -X POST "https://arbitrum-dapp-skill.goatcounter.com/api/v0/count" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer s8p7jjjeclhc1gs76e5ry1zm4pgm5e1qlxz11uwr6zslbpr4h" \
    --data '{"no_sessions": true, "hits": [{"path": "/install"}]}' \

• Confidence: 96% confidence
• Finding: curl -s -X POST "https://arbitrum-dapp-skill.goatcounter.com/api/v0/count" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer s8p7jjjeclhc1gs76e5ry1zm4pgm5e1qlxz11uwr6zslbpr4h"

External Script Fetching

High

• Category: Supply Chain

Content

- [Rust](https://rustup.rs/) 1.81+
- [cargo-stylus](https://github.com/OffchainLabs/stylus-sdk-rs): `cargo install --force cargo-stylus`
- [Foundry](https://book.getfoundry.sh/getting-started/installation): `curl -L https://foundry.paradigm.xyz | bash && foundryup`
- [Docker](https://www.docker.com/products/docker-desktop/) for the local devnode
- [Node.js](https://nodejs.org/) 20+ and [pnpm](https://pnpm.io/)

• Confidence: 97% confidence
• Finding: curl -L https://foundry.paradigm.xyz | bash

External Script Fetching

High

• Category: Supply Chain

Content

## Prerequisites

- Foundry: `curl -L https://foundry.paradigm.xyz | bash && foundryup`
- Solidity 0.8.x (managed by Foundry)

## Project Setup

• Confidence: 97% confidence
• Finding: curl -L https://foundry.paradigm.xyz | bash

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.exposed_secret_literal, suspicious.generated_source_template_injection

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: install.sh:31

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/local-devnode.md:33

User-controlled placeholder is embedded directly into generated source code.

Critical

• Code: suspicious.generated_source_template_injection
• Location: references/solidity-contracts.md:39