T09 · Insecure Skill Coding Practices
Error
- Location
scripts/relay-bridge.js:90- Finding
Bridge Script Sends Mainnet ETH Without Destination Routing Data
- Content
View full analysis
- Remediation
View remediation
Security audit
Abstract Toolkit
Security checks for vulnerabilities and agentic risk
Overview
This skill is a real blockchain automation helper, but it can move mainnet funds with raw private keys and has weak safeguards around irreversible transactions.
Review this carefully before installing. Use only a dedicated low-value wallet, test on testnet or tiny amounts first, pin dependencies, and manually verify every destination, router, bridge route, contract function, and transaction before signing. Do not use a primary or treasury private key with this skill as written.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/transfer.js:61- Finding
Successful Transfers Are Reported as Failures Due to Block-Scoped Transaction Variables
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:103- Finding
Security-Sensitive Dependencies and Compiler Are Installed Without Version Pinning
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (14)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The documented behavior and the described capability surface do not line up cleanly: the skill introduces AGW creation and references broad operational abilities without a tightly bounded, auditable implementation contract. In security-sensitive blockchain workflows, this mismatch can mislead users or orchestrators about what actions the skill may perform, increasing the risk of unintended wallet setup or asset-affecting operations.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/check-balances.js <wallet> all
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/check-balances.js <wallet> all
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill clearly relies on sensitive environment-provided credentials such as WALLET_PRIVATE_KEY, but the manifest declares no explicit tool scope or permissions boundary. In an agent setting, missing scope declarations can cause overbroad access to secrets or make operators unaware that the skill is capable of initiating authenticated on-chain actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation repeatedly instructs users to export WALLET_PRIVATE_KEY without any warning about credential sensitivity, secure storage, shell history leakage, or reuse risk. Exposing raw private keys in a general-purpose agent workflow materially increases the chance of secret theft and total wallet compromise.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill provides ready-to-run instructions for bridging, deploying contracts, transferring tokens, swapping assets, and writing to arbitrary contracts, yet it does not prominently warn that these are irreversible on-chain operations that may result in permanent fund loss. In an agent-driven context, this omission is especially dangerous because users may treat the workflow as routine automation rather than high-risk financial execution.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation instructs users to export a raw wallet private key into an environment variable and immediately use it for blockchain operations, but provides no warning about secure handling, shell history exposure, process inspection, or safer alternatives. In a skill focused on deploying contracts and moving assets, this can directly lead to theft of funds if users copy real funded keys into insecure environments or shared agent/runtime contexts.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
In write mode, the script immediately submits whatever contract function, arguments, and ETH value were provided on the command line, with no confirmation, allowlist, simulation, or human review step. In an agent skill intended to deploy contracts, bridge assets, trade, and transfer funds on mainnet, this makes accidental or prompt-influenced irreversible transactions materially more dangerous.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script directly submits approval and swap transactions once invoked, without any final confirmation step that shows the exact token, amount, router, path, and minimum output. In an agent skill context, this increases the chance of unintended irreversible asset movement due to bad parameters, prompt injection into tool usage, or operator error, especially because approvals and swaps can immediately change token balances and expose allowance to the configured router.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The script reads WALLET_PRIVATE_KEY from the environment to authorize blockchain transfers, which is a sensitive credential operation. Although the usage comment tells the user to set the variable, it does not warn about the security implications of exposing or mishandling a private key.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script performs irreversible ETH and token transfers immediately after parsing CLI arguments, without any confirmation prompt, simulation, or recipient sanity checks. In an agent skill that is explicitly designed to move assets on mainnet, this increases the chance that a mistaken address, wrong token symbol/address, or malformed amount will result in permanent loss of funds.
- Content
Static analysis
No suspicious patterns detected.