Security audit

Carrier Reliability Signal

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to provide a legitimate paid carrier-reliability lookup, but it requires a raw EVM wallet private key without enough limits or handling details.

Install only with a dedicated low-balance payment wallet, not a primary wallet or operational treasury key. Look for clearer documentation of the x402 flow, exact charges, recipient, limits, and signing protections before trusting it for repeated use.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:6
Finding: Raw Mainnet Wallet Private Key Required Without Documented Security Controls
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill declares a requirement for EVM_PRIVATE_KEY even though its stated purpose is read-only carrier reliability forecasting via an HTTPS endpoint. Requesting a blockchain private key creates unnecessary access to highly sensitive credentials that could be exposed, misused for unauthorized transactions, or repurposed beyond micropayment needs, and the mismatch between capability and business function increases suspicion.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.