Create Aptos Project

• Outcome: Review
• Latest audit: Sep 12, 2026 · 6:26 AM UTC
• Version: 1.0.0

Overview

This Aptos scaffolding skill is not clearly malicious, but it needs review because it can activate for generic app requests and encourages unpinned remote npx execution, including an auto-confirm option.

Install only if you specifically want an Aptos scaffolding assistant. Before running its commands, pin create-aptos-dapp to a reviewed version, avoid npx --yes, run scaffolding in a limited workspace without unrelated secrets, and require separate explicit approval before Aptos account initialization, git commits, or any deployment.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:20

Finding

Broad Trigger Rules Hijack Generic Project-Creation Requests

Content

View full analysis

scaffold with `npx create-aptos-dapp` (this skill — NEVER skip) 2. `/write-contracts` -> write Move modules 3. `/generate-tests` -> create test suite, verify 100% coverage 4. `/security-audit` -> audit before deployment 5. `/deploy-contracts` -> deploy contract to specified network 6. `/use-ts-sdk` -> orchestrates frontend integration (routes to ts-sdk-client, ts-sdk-transactions, ts-sdk-v ...[truncated 2236 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: SKILL.md:80

Finding

Unpinned npm Package Is Downloaded and Executed Through npx

Content

View full analysis

\ --project-type fullstack \ --template boilerplate-template \ --framework vite \ --network # Fullstack dApp with Next.js npx create-aptos-dapp \ --project-type fullstack \ --template boilerplate-template \ --framework nextjs \ --network # Contract-only (Move project) npx create-aptos-dapp \ --project-type move \ --network ``` ```bash # Auto-confirm the npx package install prompt npx --yes create-aptos-dapp ... ``` ### Technical Analysis The commands identify `create-aptos-dapp` only by package name and do not pin an exact version. When the package is not already available locally, `npx` can resolve it from the configured npm registry, download it, and execute its CLI entry point. The effective code therefore can change after this skill has been reviewed. The troubleshooting instruction additionally uses `--yes`, suppressing the package-install confirmation. No lockfile, package integrity value, provenance verification, trusted registry restriction, or reviewed version is specified. This creates a supply-chain execution boundary: compromise of the package, one of its install-time dependencies, the configured registry, or package ownership can turn an ordinary scaffold command into code execution with the invoking agent’s operating-system permissions. ### Attack Path 1. The skill directs the agent to invoke the unversioned `create-aptos-dapp` package through `npx`. 2. `npx` resolves the current package version from the configured npm registry. 3. A compromised or unexpectedly changed release is downloaded. 4. With `--yes`, installation proceeds without an interactive approval checkpoin ...[truncated 948 chars]

Remediation

View remediation

create-aptos-dapp ... ``` 2. Do not use version ranges or tags such as `latest`. 3. Remove `--yes` so package installation remains an explicit approval boundary. 4. Prefer installing the pinned package in a controlled project with a committed lockfile and then invoking the local binary. 5. Verify npm provenance, publisher identity, package signatures where available, and registry integrity metadata before execution. 6. Restrict installation to an approved registry and consider allowlisting exact package names and versions. 7. Run scaffolding in a sandbox with minimal filesystem access, no unrelated secrets, constrained network access, and no elevated privileges. 8. Review version changes before updating the pin and document the verified package checksum or integrity value. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger phrases include very broad terms like build app, new project, scaffold, and help me build, which can match many ordinary requests outside the intended Aptos-specific context. Over-broad activation can cause the skill to take over unrelated conversations and steer users into running scaffold commands they did not specifically request.

Content

No source excerpt is available for this finding.

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Declaring the skill the mandatory first step for building any new Aptos app regardless of phrasing makes its activation scope effectively universal. This is risky because it suppresses contextual judgment and can push users into an unnecessary or premature command-execution workflow.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md

1. **Skip scaffolding** — even for "simple" projects, always start with `create-aptos-dapp`
2. **Create project structure manually** — the boilerplate template handles this
3. **Display or read private keys** — use `"0x..."` as placeholder
4. **Run `git add .` or `git add -A`** without first verifying `.env` is in `.gitignore`

---

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The manifest-level description embeds an unpinned npx create-aptos-dapp reference, which encourages unsafe copy-paste behavior before users reach the detailed instructions. While less directly executable than a command block, it still contributes to the same supply-chain risk pattern.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The skill repeatedly instructs use of npx create-aptos-dapp without pinning an exact package version, so execution depends on whatever package version is current at runtime. This creates a supply-chain risk: a compromised upstream release or typo-squatted replacement could run arbitrary code on the user's machine during scaffolding.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Mandating npx create-aptos-dapp as the required first step without a version pin means the skill operationalizes execution of an unpinned remote package. Because scaffolding tools execute code during install/runtime, this exposes users to arbitrary code execution if the package or dependency chain is compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The instruction to always use npx create-aptos-dapp and never scaffold manually increases the chance users will execute unreviewed remote code immediately. Without version pinning, the package contents can change over time, making the build process non-reproducible and vulnerable to supply-chain compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This scaffold command invokes an unpinned package with npx, which may download and execute the latest package and dependencies. That behavior is dangerous in a security-sensitive project setup workflow because any malicious upstream update can execute before the user has a chance to inspect generated files.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The Next.js scaffold example has the same unpinned npx execution risk as the Vite example. Because this is presented as a standard command for users to run, it directly propagates a supply-chain exposure into developer workstations.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The contract-only command still executes unpinned remote code via npx, so it carries the same arbitrary code execution and reproducibility risks. The context makes this more dangerous because the skill states scaffolding must always be used, leaving users no safer default path.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The workflow section repeats broad trigger wording without boundaries, reinforcing over-activation behavior established earlier. While not directly executing code, this makes the skill more likely to inappropriately route users into the scaffolding flow.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

Reinforcing npx create-aptos-dapp as an always-required workflow step amplifies the impact of the unpinned package risk across all project creations. In practice, this turns a documentation issue into a systemic supply-chain weakness for anyone following the workflow.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The troubleshooting section again references the unpinned npx create-aptos-dapp command, normalizing runtime installation of a mutable upstream package. Repetition across sections increases the chance users copy and run an unsafe command verbatim.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 89% confidence

Finding

The troubleshooting guidance explicitly recommends auto-confirming the npx package install prompt. Removing the confirmation step weakens user awareness and reduces a safety checkpoint before downloading and executing code from the network.

Content

Scanner excerpt · SKILL.md (reported line 157)May include surrounding context.

npx create-aptos-dapp command not found

bash

# Auto-confirm the npx package install prompt
npx --yes create-aptos-dapp <project-name> ...

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

npx --yes create-aptos-dapp both leaves the package unpinned and suppresses the interactive install confirmation, reducing friction for executing remote code. Combining automatic confirmation with a floating package version materially increases supply-chain risk and makes accidental execution more likely.

Content

No source excerpt is available for this finding.