Apechain Reader

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:57 PM UTC
• Version: 3.1.0

Overview

WalletLens is a user-invoked blockchain lookup skill that reads public on-chain data, with some documentation overclaims but no hidden persistence, credential theft, destructive behavior, or transaction authority.

This skill is reasonable to install if you are comfortable sending investigated wallet addresses, chain choices, and contract addresses to public RPC services, CoinGecko, and optionally Alchemy. Do not provide private keys or seed phrases. Treat bot scores as heuristics for review, not as proof or as the sole basis for financial, moderation, or access decisions. ENS support is advertised but currently unavailable in the inspected code.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (41)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The description presents a broad wallet analysis tool with pricing, naming resolution, ENS, due diligence, transaction investigation, and cross-chain support. The supplied code only performs NFT-focused bot detection heuristics using RPC log queries and limited block timestamp lookups. While bot detection on multiple EVM chains is partially aligned, the code lacks most of the declared capabilities and even omits Avalanche from the wrapped-token map/support shown here. This is a material description-behavior mismatch because the actual primary purpose is much narrower than advertised.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description presents a broad wallet-analysis and due-diligence tool with pricing, portfolio analysis, transaction history, ENS support, and bot detection across multiple networks. The supplied code chunk is much narrower: it is a contract-info script that performs direct JSON-RPC calls to inspect whether an address has bytecode and, if so, queries a few standard contract methods to infer token type and metadata. While one small part of the description mentions inspecting smart contract details and token information, that is only a subset of the advertised functionality. The primary purpose of the code chunk is contract metadata inspection, not advanced wallet analysis. Therefore the description does not accurately represent what this code chunk actually does.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: There is a material description/behavior mismatch for this supplied code chunk. While several declared support features are present as infrastructure—8-chain configuration, retrying RPC helper, USD native-token price lookup, collection-name resolution, and human-readable formatting—the headline description portrays a complete advanced analyzer. This file is only a helper library, not the analyzer implementation itself. Most importantly, ENS support is affirmatively claimed, but the active code path in parseArgs throws an error for .eth inputs and marks ENS resolution as temporarily unavailable, despite dormant resolveENS/namehash functions existing. The rest of the discrepancy is that the chunk formats and supports outputs for wallet/contract/tx/NFT/bot scripts but does not itself perform those analyses. That is a meaningful overstatement relative to the provided code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents a broad, advanced wallet analysis skill with many capabilities: USD valuation, ENS support, smart contract and token inspection, transaction-history analysis, bot detection, due diligence, and cross-chain insights. The supplied code does not implement those features. It only retrieves ERC-721 transfer logs for a given address on a chosen chain, derives current holdings by netting inbound and outbound NFT transfers, optionally filters by collection contract, and resolves collection names. While it is multi-chain in the sense that it accepts a chain selector, it analyzes only one chain per execution and only NFT holdings. This is a materially narrower primary purpose than the declared description, so the description does not accurately represent the code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents a comprehensive multi-chain wallet analysis skill with pricing, naming resolution, ENS support, portfolio analytics, contract inspection, bot detection, and cross-chain due diligence. The supplied code chunk is much narrower: it fetches recent Transfer event logs for one address on one selected chain using RPC and formats them as a simple history. It distinguishes ERC-20 vs NFT transfers based on topic count and derives basic fields, but does not implement the majority of the advertised analysis features. This is a material description-behavior mismatch because the primary purpose in the code is limited transaction/transfer log retrieval rather than advanced wallet analysis.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The code generally fits part of the declared wallet-analysis purpose: it supports multiple EVM chains via a chain selector, computes native balance and USD value, identifies whether an address is a contract, tracks NFT holdings by parsing ERC-721 Transfer logs, resolves collection names, and produces human-readable output. However, the description significantly overstates the implemented functionality. There is no visible ENS resolution, no advanced bot-detection logic, no comprehensive smart contract or token inspection, and no real cross-chain aggregation or investigation beyond choosing one chain per run. Its transaction analysis is narrow, limited to transaction count and recent NFT transfer events over a fixed block window. Therefore, the declared description does not accurately represent what this specific code chunk actually does.

Ae1

High

• Category: analysis-evasion

Content

node scripts/wallet-lookup.js 0x8dd6390be6dc732c92b161b9793a3948b56c0126

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/wallet-lookup.js 0x8dd6390be6dc732c92b161b9793a3948b56c0126

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/wallet-lookup.js 0x8dd6390be6dc732c92b161b9793a3948b56c0126

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/wallet-lookup.js 0x8dd6390be6dc732c92b161b9793a3948b56c0126

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/wallet-lookup.js 0x8dd6390be6dc732c92b161b9793a3948b56c0126

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/wallet-lookup.js 0x8dd6390be6dc732c92b161b9793a3948b56c0126

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/wallet-lookup.js 0x8dd6390be6dc732c92b161b9793a3948b56c0126

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/wallet-lookup.js 0x8dd6390be6dc732c92b161b9793a3948b56c0126

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/wallet-lookup.js 0x8dd6390be6dc732c92b161b9793a3948b56c0126

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/wallet-lookup.js 0x8dd6390be6dc732c92b161b9793a3948b56c0126

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/contract-info.js <address> [--chain <name>] [--pretty]

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/bot-detect.js <address> [--chain <name>] [--pretty]

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

node scripts/bot-detect.js <address> [--chain <name>] [--pretty]

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

No environment variables required. The skill uses public RPC endpoints configured in `scripts/lib/rpc.js`.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

No environment variables required. The skill uses public RPC endpoints configured in `scripts/lib/rpc.js`.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Credential Access

High

• Category: Privilege Escalation

Content

- ✅ Works perfectly without any env vars (public RPC fallback)

### Keychain Integration  
- ❓ macOS Keychain support not tested (no keychain access in environment)
- 📝 Environment variable check working correctly

---

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises networked functionality and optional environment-variable use, but does not declare an explicit tool scope such as allowed network or env access. In agent ecosystems, missing scope declarations can lead to broader-than-expected execution privileges and make review, containment, and policy enforcement harder.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation omits a clear privacy warning that wallet addresses and query data are sent to third-party public RPC providers and optional external services. Users may reasonably treat addresses under investigation as sensitive, and silent disclosure to third parties can expose research targets, internal investigations, or user behavior.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: Heuristic bot labeling without an explicit warning can cause users to overtrust probabilistic output and take adverse action against legitimate addresses. In due-diligence or moderation workflows, false positives can result in reputational, financial, or access harms even if the underlying code is functioning as designed.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/lib/rpc.js:175