lex

• Outcome: Pass
• Latest audit: Jul 10, 2026 · 4:08 AM UTC
• Version: 1.0.0

Overview

This appears to be a legitimate Warden/LangGraph agent-building helper, with some setup and documentation hygiene risks but no evidence of hidden or malicious behavior.

Install this only for Warden Protocol or clearly Warden-related LangGraph agent work. Run the initializer in a chosen workspace, review generated dependencies before installing them, keep real API keys out of source control, replace example database credentials before any non-local deployment, avoid logging raw prompts or sensitive wallet/account data, and test only endpoints you trust.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill instructs the agent to use powerful capabilities including shell commands, network access, environment-variable handling, and file creation/modification, but it does not declare permissions or boundaries for those actions. This creates a hidden capability mismatch: a caller may invoke the skill without realizing it can access secrets, write files, or perform networked/deployment actions, increasing the chance of unintended execution or privilege misuse.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger phrase "LangGraph agent" is overly broad for a skill that performs specialized Warden Protocol agent-building actions. In a tool-routing system, this can cause the skill to activate on unrelated LangGraph requests, exposing users to irrelevant instructions, unintended repository/script usage, or context hijacking by a mismatched skill.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: Stating that the skill triggers when users mention "Warden or LangGraph agents" makes activation too permissive, especially because "LangGraph agents" is a broad category unrelated to Warden. In an agentic environment, this increases the risk of incorrect skill selection, causing inappropriate instructions, unnecessary script references, or accidental steering toward Warden-specific workflows.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The example .env template includes a fully formed PostgreSQL connection string with placeholder username and password values (`user:pass`) but does not explicitly warn readers to replace them with strong, unique credentials. In practice, sample credentials are often copied into real deployments, which can lead to weak/default database access if exposed beyond a trusted environment.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The Docker Compose example configures PostgreSQL with default credentials (`postgres` / `postgres`) and a static database name without any warning that this is for local development only. If reused in staging or production, or if the service becomes reachable from other containers/hosts, attackers could authenticate trivially and access or modify database contents.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The structured logging example includes `logger.debug('Processing request', { input });`, which can capture raw user prompts, wallet data, API payloads, or other sensitive content in logs. In an agent deployment guide, readers may copy this pattern directly into production, creating a persistent data exposure path through console, file, or centralized log backends.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: Broad trigger guidance can cause the skill to activate in contexts where the user did not intend to invoke it, increasing the chance that unrelated prompts are influenced by this skill's instructions, references, or helper scripts. In an agentic system, over-broad auto-invocation expands the attack surface for prompt-confusion, unintended tool use, and incorrect workflow selection.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The documented automatic triggers include ambiguous terms that overlap with normal discussion of Warden, agents, or incentive programs, making unintended invocation likely. Because this skill is capable of steering implementation and potentially leading to script execution in the host environment, accidental triggering can cause inappropriate actions or contaminate unrelated conversations with domain-specific instructions.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: The schema-guided reasoning pattern sends raw user input to an external LLM multiple times and also fetches third-party data, but the documentation provides no disclosure, minimization, or guardrails around outbound data handling. In a Web3/agent-builder context, users may paste wallet-related or sensitive operational data into examples they treat as production-ready, creating a realistic risk of unintended third-party data exposure.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: This pattern demonstrates extracting items from user input, querying external APIs for each item, and then sending aggregated results to an external LLM, all without warning or restrictions. Because it encourages parallel fan-out, it can amplify unintended disclosure and outbound request volume if adopted directly in production agent code.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The quick reference instructs users to place sensitive credentials such as OPENAI_API_KEY and LANGSMITH_API_KEY in environment configuration, but it does not warn against committing a .env file or otherwise exposing secrets in source control, logs, screenshots, or published examples. In a skill specifically meant to help users build and publish agents, this omission increases the chance of accidental credential leakage during setup or deployment.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.