Security audit

Abstract Onboard

Security checks for vulnerabilities and agentic risk

Overview

This Abstract blockchain toolkit is not clearly deceptive, but it can sign irreversible mainnet transactions and leave persistent token approvals with too little validation or confirmation.

Treat this as a high-risk crypto automation skill. Use only a dedicated low-balance wallet first, verify every recipient, contract, router, spender, chain, amount, and slippage manually, avoid the Relay and arbitrary contract-write paths unless reviewed, revoke token allowances after use, and pin/audit dependencies before using real funds.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/aborean-swap.js:105
Finding: Swaps Execute Without Minimum-Output Protection
Content: View full analysis
Remediation: View remediation
0`. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/myriad-buy-direct.js:107
Finding: Persistent Unlimited Token Allowances Exceed Transaction Requirements
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/bridge-usdc-relay.js:22
Finding: Relay API Response Is Blindly Signed as Arbitrary Blockchain Transactions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/myriad-buy-direct.js:15
Finding: Myriad API Credentials Are Exposed in URL Query Strings
Content: View full analysis
String(m.id) === String(marketId)); } ``` `scripts/myriad-trade.js`: ```javascript const ABSTRACT_RPC = 'https://api.mainnet.abs.xyz'; const PRIVATE_KEY = process.env.WALLET_PRIVATE_KEY; const MYRIAD_API_KEY = process.env.MYRIAD_API_KEY_PROD; const MYRIAD_API_URL = 'https://api-v2.myriadprotocol.com'; async function listMarkets() { const res = await fetch(`${MYRIAD_API_URL}/markets?api_key=${MYRIAD_API_KEY}&state=open&limit=10&sort=volume`); const json = await res.json(); const data = json.data || json; // ... } async function getMarketInfo(marketId) { const res = await fetch(`${MYRIAD_API_URL}/markets?api_key=${MYRIAD_API_KEY}&state=open`); const json = await res.json(); const markets = json.data || json; // ... } ``` ### Technical Analysis The Myriad API key is embedded in the URL query string. Although HTTPS protects the request in transit and the destination is the documented Myriad API, URLs are frequently retained by application servers, reverse proxies, observability products, error reporters, and network tooling. Unlike authorization headers, query parameters are commonly logged as part of the request target. Anyone with access to such logs may recover and reuse the API key. If the variable is unset, the literal value `undefined` is al ...[truncated 997 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: package.json:8
Finding: Mutable and Incomplete Dependency Configuration Undermines Supply-Chain Controls
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (52)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description presents a comprehensive Abstract L2 operations skill, but the actual code chunk is narrowly focused on instantiating an AGW client and obtaining the AGW address for an EOA. This is a materially different primary purpose from the declared one. While AGW creation is related to Abstract ecosystem interaction, it is not mentioned in the description, and none of the highlighted declared functions are implemented in this chunk. Therefore the description does not accurately represent this code's behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The description presents a full-featured operational skill for deploying contracts and performing on-chain actions on Abstract. The actual code chunk is much narrower: it only estimates gas/fees using ethers against the Abstract RPC. Although gas estimation is related to transacting on Abstract, it is not mentioned in the declared purpose and, more importantly, the advertised core capabilities are not implemented in this code. The code also does not contain swap logic despite the usage comment mentioning 'swap'. This is a material description-behavior mismatch because the primary purpose of the code is estimation/inspection, not execution of deployments, bridges, trades, predictions, transfers, or balance checks.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a comprehensive operational skill for interacting with Abstract, including deployments, bridging, swaps, prediction markets, transfers, and mainnet usage. The supplied code does none of those substantive actions. It is limited to a testnet onboarding/check script that reads network state and outputs setup instructions. The primary purpose is materially different: testnet setup verification rather than contract deployment and asset operations on Abstract. While checking balances is one small overlap, the overall description substantially overstates the implemented behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents a comprehensive skill for deploying, bridging, trading, predicting, transferring, and broader Abstract mainnet operations. The supplied code does not implement any of those core capabilities. Instead, it only validates an address, queries bytecode via RPC, and reports whether a contract exists at that address. While this is loosely related to Abstract mainnet interaction, the primary purpose is materially different and far narrower than the declared behavior. There are no undeclared dangerous actions; the mismatch is that the description substantially overstates and misrepresents what this code chunk actually does.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The code chunk does not implement the major declared functions such as deployment, bridging, trading, predictions, or transfers. Instead, its primary purpose is read-only blockchain monitoring on Abstract using ethers.js and RPC polling. While this still interacts with Abstract mainnet, that is far narrower and materially different from the declared operational scope. The undeclared/underdeclared primary behavior here is event watching and block/log monitoring, making the description inaccurate for this specific code chunk.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.
md
node scripts/check-balances.js <wallet> all

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 217)May include surrounding context.
md
node scripts/check-balances.js <wallet> all

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README gives actionable instructions for irreversible blockchain operations—bridging, transfers, swaps, approvals, contract writes, deployment, and prediction-market purchases—without consistently requiring confirmation, recipient/address verification, slippage review, spender verification, or warning about finality and asset loss. In agent contexts, this can normalize direct execution of financially dangerous actions and lead to permanent loss from wrong addresses, malicious spenders, bad routes, or unintended approvals.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.
md
node scripts/myriad-trade.js list

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.
md
node scripts/myriad-trade.js list

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 228)May include surrounding context.
md
node scripts/myriad-trade.js list

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.
md
node scripts/testnet-setup.js faucet

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.
md
node scripts/testnet-setup.js faucet

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.
md
node scripts/testnet-setup.js faucet

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 234)May include surrounding context.
md
node scripts/testnet-setup.js faucet

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script signs and submits bridge transactions directly from a hot wallet based on API-provided transaction data, with no interactive confirmation, allowlisting, simulation, or sanity checks before funds are moved. In this skill context, that is especially dangerous because bridging is irreversible and the script is designed to move essentially the entire USDC balance, so a bad quote, compromised API response, or accidental invocation can immediately cause loss of funds.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: In write mode, the script signs and submits transactions to any supplied contract using the wallet private key from the environment, with no validation of target contract, method, or argument safety. In an agent setting, this is a powerful arbitrary-write primitive that could transfer tokens, grant approvals, change contract state, or interact with malicious contracts, leading to irreversible loss of funds or unauthorized actions.
Content: No source excerpt is available for this finding.

Obfuscated Code

High

Category: Supply Chain
Confidence: 50% confidence
Finding: Code contains obfuscation (base64, hex encoding with execution). This is often used to hide malicious functionality.
Content: Scanner excerpt · scripts/mint-nft.js (reported line 36)May include surrounding context.
js
// Pre-compiled zkSync bytecode for simple NFT // This is a minimal ERC721-like contract const NFT_BYTECODE = "0x00050000000000020000008003100270000000130430019700030000003103550002000000010355000100000000030200000000030100190000006001100270000000130010019d000000130300004100000001022001900000002f0000c13d0000008002000039000000400020043f0000000002000416000000000302004b000000330000c13d0000001f023000390000001404200197000000400200043d0000000003240019000000000443004b00000000040000190000000104004039000000150530009c000000c80000213d0000000104400190000000c80000c13d000000400030043f000000000531034f000000000505043b000000160550009c000000350000213d00000000045400190000001f05400039000000000065004b00000000060000190000000106002039000000010660018f000000000556004b000000350000c13d000000200540003900000017064001980000004d0000613d000000000701034f0000000008020019000000007907043c0000000008980436000000000058004b000000490000c13d0000001f05400039000000180650019700000000045404360000000003030433000000000534004b0000005a0000613d000000000501001900000000560504340000000004640436000000000036004b000000560000413d0000001f0330003900000018043001970000000003240019000000000043004b00000000040000390000000104004039000000150430009c000000c80000213d0000000104400190000000c80000c13d000000400030043f00000020042000390000000000140435000000130100004100000000001004350000000201000039000001a40010043f000001c4020000390000000001000019000000c20000013d0000000001000416000000000101004b000000330000c13d0000000001000019000000c20000013d0000008001000039000000400010043f0000000001000019000000c20000013d00000014010000410000000000100443000000000100041400000013020000410000000003000414000000130430009c0000000003018019000000c0013002100000001902100041000000c50000013d000000000001042f000000c00010043f000000e00000043f0000001a0100004100000000001004350000000101000039000000040010043f0000001b010000410000015a000104300000001501000041000000000010043f0000004101000039000000040010043f0000001b010000410000015a00010430000000400100043d0000001c02000041000000000021043 ...[truncated 26 chars]

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
Content: Scanner excerpt · scripts/mint-nft.js (reported line 36)May include surrounding context.
js
I) returns (uint256)", "function ownerOf(uint256 tokenId) view returns (address)", "function tokenURI(uint256 tokenId) view returns (string)", "function totalSupply() view returns (uint256)", "function name() view returns (string)", "function symbol() view returns (string)" ]; // Pre-compiled zkSync bytecode for simple NFT // This is a minimal ERC721-like contract const NFT_BYTECODE = "0x00050000000000020000008003100270000000130430019700030000003103550002000000010355000100000000030200000000030100190000006001100270000000130010019d000000130300004100000001022001900000002f0000c13d0000008002000039000000400020043f0000000002000416000000000302004b000000330000c13d0000001f023000390000001404200197000000400200043d0000000003240019000000000443004b00000000040000190000000104004039000000150530009c000000c80000213d0000000104400190000000c80000c13d000000400030043f000000000531034f000000000505043b000000160550009c000000350000213d00000000045400190000001f05400039000000000065004b0000000006000019000000

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/myriad-buy-direct.js (reported line 10)May include surrounding context.
js
* Example: node scripts/myriad-buy-direct.js 765 0 1 (buy $1 on Yes) */ require('dotenv').config({ path: '.env.local' }); const { createPublicClient, createWalletClient, http, parseAbi, formatUnits, encodeFunctionData, parseUnits } = require('viem'); const { privateKeyToAccount } = require('viem/accounts');

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/myriad-trade.js (reported line 12)May include surrounding context.
js
* Example: node scripts/myriad-buy-direct.js 765 0 1 (buy $1 on Yes) */ require('dotenv').config({ path: '.env.local' }); const { createPublicClient, createWalletClient, http, parseAbi, formatUnits, encodeFunctionData, parseUnits } = require('viem'); const { privateKeyToAccount } = require('viem/accounts');

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script grants the router an unlimited USDC allowance via MaxUint256, which creates persistent spend authority far beyond the intended $1 swap. If the router address is compromised, upgraded maliciously, misconfigured, or interacted with through another code path, the wallet's entire USDC balance could be drained without further approval. In this skill context, the danger is elevated because the script is explicitly designed for live mainnet asset operations using a private key.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script directly approves MaxUint256 USDC allowance and then executes a live swap from a wallet loaded via WALLET_PRIVATE_KEY, with no interactive confirmation, simulation, dry-run guard, or environment gating. In the context of an agent skill meant to deploy and trade on mainnet, this is especially dangerous because any accidental invocation, misconfiguration, compromised router address, or manipulated pricing/liquidity can immediately cause irreversible fund loss.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill clearly expects access to environment variables and outbound network connectivity, including private keys in WALLET_PRIVATE_KEY and blockchain/API endpoints, but it declares no explicit tool scope or permissions. In an agent setting, missing scope boundaries increases the chance the skill is invoked with broader-than-necessary capabilities and can perform sensitive wallet or network actions without clear policy review.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation text is extremely broad and covers many common blockchain tasks, including transfers, swaps, deployment, bridging, and contract interaction. In an autonomous or semi-autonomous agent, such broad matching can cause this high-risk skill to be selected in situations where a narrower read-only or safer skill would be more appropriate, increasing the chance of unintended fund movement or contract writes.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/bridge-usdc-relay.js:4

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/myriad-buy-direct.js:16

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/myriad-trade.js:15