NEAR Agent Skills

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:07 PM UTC
• Version: 1.0.0

Overview

This skill is a read-only NEAR analytics and gas helper with expected network lookups, but its npm dependencies and third-party data disclosure need attention.

Install only in an environment where npm dependencies can be updated or isolated. Treat NearBlocks calls as third-party lookups of public account identifiers, and avoid using this package with private keys or wallet credentials unless the dependency chain is reviewed and patched.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (29)

Known Vulnerable Dependency: vitest==4.0.18 — 2 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed); CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Critical

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: vitest 4.0.18 is present with advisories for arbitrary file read and, in some configurations, file execution when the UI server is listening. Although Vitest is a dev dependency, the issue is real and can materially impact developer workstations or CI runners if test UI or mock features are exposed to untrusted input; the presence of related @vitest/mocker amplifies that risk.

Known Vulnerable Dependency: vitest==4.0.18 — 2 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed); CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Critical

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: vitest 4.0.18 is flagged with critical advisories including arbitrary file read and possible file execution conditions when the Vitest UI server or mocker features are exposed. Even though it is a dev dependency, this is dangerous because test tools execute code locally and in CI, and agent-skill repositories may be run by developers or automation with access to secrets, source, and build credentials.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The code only fetches external analytics-style data from NEAR RPC and NearBlocks APIs and returns summaries. This aligns partially with the 'on-chain analytics' portion of the description, but it does not implement any gas optimization capability, transaction construction, execution, or broader agentic NEAR protocol tooling. Therefore the declared description materially overstates the functionality and includes a specific capability not present in the code.

Known Vulnerable Dependency: base-x==2.0.6 — 1 advisory(ies): CVE-2025-27611 (Homograph attack allows Unicode lookalike characters to bypass validation.)

High

• Category: Supply Chain
• Confidence: 80% confidence
• Finding: base-x 2.0.6 is flagged for a homograph/Unicode lookalike validation bypass issue. Although this package is a transitive dependency used for base58 handling and the lockfile alone does not prove unsafe input validation in application code, the vulnerable version is present and could affect address or identifier validation if attacker-controlled Unicode input is accepted.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 80% confidence
• Finding: form-data 4.0.5 is reported vulnerable to CRLF injection through unescaped multipart field names. In this lockfile it is only pulled in via @types/node-fetch as a dev dependency, so the vulnerable package exists, but the practical risk is reduced because type packages do not themselves process requests at runtime unless the runtime package is also used in that unsafe pattern.

Known Vulnerable Dependency: nanoid==3.3.11 — 3 advisory(ies): CVE-2026-67214 (nanoid: non-secure generators can loop indefinitely with negative size); CVE-2026-67213 (nanoid: custom generators can loop indefinitely when size is zero); CVE-2026-73086 (nanoid: Integer Overflow or Wraparound)

High

• Category: Supply Chain
• Confidence: 80% confidence
• Finding: nanoid 3.3.11 is present with advisories for infinite loops and integer handling issues in certain generator usage patterns. Because it is a transitive dev dependency used by tooling such as PostCSS, the finding is real, but the impact is primarily denial of service in build/dev workflows rather than direct compromise of blockchain operations.

Known Vulnerable Dependency: picomatch==4.0.3 — 2 advisory(ies): CVE-2026-33672 (Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Mat); CVE-2026-33671 (Picomatch has a ReDoS vulnerability via extglob quantifiers)

High

• Category: Supply Chain
• Confidence: 80% confidence
• Finding: picomatch 4.0.3 has advisories for method injection and ReDoS in glob matching. Since it is a transitive dependency of dev tooling, the issue is real, and it can become relevant if untrusted glob patterns are processed in CI, developer tools, or build plugins.

Known Vulnerable Dependency: postcss==8.5.6 — 4 advisory(ies): CVE-2026-45623 (PostCSS: Arbitrary file read and information disclosure via attacker-controlled ); CVE-2026-69153 (PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappi); CVE-2026-41305 (PostCSS has XSS via Unescaped </style> in its CSS Stringify Output) +1 more

High

• Category: Supply Chain
• Confidence: 84% confidence
• Finding: postcss 8.5.6 is flagged for multiple issues including arbitrary file read and XSS-related behavior in tooling contexts. The package is present as a dev dependency through Vite, making the dependency finding valid, but the danger is mainly in build/dev server workflows and front-end asset processing rather than core NEAR transaction logic.

Known Vulnerable Dependency: rollup==4.57.1 — 1 advisory(ies): CVE-2026-27606 (Rollup 4 has Arbitrary File Write via Path Traversal)

High

• Category: Supply Chain
• Confidence: 82% confidence
• Finding: rollup 4.57.1 is present with an advisory for arbitrary file write via path traversal. This is a real issue in the build toolchain and could impact developer or CI environments if untrusted inputs, plugins, or archives are processed during bundling.

Known Vulnerable Dependency: secp256k1==5.0.0 — 1 advisory(ies): CVE-2024-48930 (secp256k1-node allows private key extraction over ECDH)

High

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: secp256k1 5.0.0 is a cryptographic dependency used by near-api-js, and the cited advisory allows private key extraction over ECDH under affected usage. In a NEAR agent skill context, crypto libraries are security-critical because compromise of key material can lead to wallet/account takeover, transaction forgery, or fund loss if vulnerable code paths are exercised.

Known Vulnerable Dependency: vite==7.3.1 — 5 advisory(ies): CVE-2026-39365 (Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling); CVE-2026-53571 (vite: `server.fs.deny` bypass on Windows alternate paths); CVE-2026-39363 (Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket) +2 more

High

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: vite 7.3.1 is present with several advisories covering path traversal and arbitrary file read in dev server behavior. This is a valid vulnerability in the development stack, and while not usually production-facing, it becomes more dangerous if developers run the Vite server on accessible hosts or use it in shared CI/test environments.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill advertises network-capable functionality but does not declare any explicit tool scope such as permissions or allowed-tools. In agent environments, missing scope declarations can cause overbroad tool access or make operators unaware that the skill may invoke network resources, increasing the chance of unintended external communication.

External Transmission

Medium

• Category: Data Exfiltration

Content

import fetch from 'node-fetch';

export async function near_analytics_network() {
  const res = await fetch('https://rpc.mainnet.near.org', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

export async function near_analytics_whales() {
  try {
    const response = await fetch('https://api.nearblocks.io/v1/txns?limit=5&sort=amount&order=desc');
    const data: any = await response.json();
    return data.txns.map((tx: any) => ({
      account: tx.signer_id,

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

export async function near_analytics_whales() {
  try {
    const response = await fetch('https://api.nearblocks.io/v1/txns?limit=5&sort=amount&order=desc');
    const data: any = await response.json();
    return data.txns.map((tx: any) => ({
      account: tx.signer_id,

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

export async function near_analytics_whales() {
  try {
    const response = await fetch('https://api.nearblocks.io/v1/txns?limit=5&sort=amount&order=desc');
    const data: any = await response.json();
    return data.txns.map((tx: any) => ({
      account: tx.signer_id,

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

export async function near_gas_history(account_id: string) {
  try {
    const response = await fetch(`https://api.nearblocks.io/v1/account/${account_id}/txns?limit=25`);
    const data: any = await response.json();
    const totalGas = data.txns.reduce((sum: number, tx: any) => sum + Number(tx.transaction_fee || 0), 0);
    return {

• Confidence: 92% confidence
• Finding: This code makes an external network request to api.nearblocks.io using a user-controlled account identifier embedded in the URL path. In a skill executed by an agent, such outbound transmission can leak sensitive operational context or user-linked identifiers to a third party and introduces dependency on an external service outside the primary trust boundary.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The function sends a user-supplied account identifier to a third-party service (nearblocks.io) without any visible disclosure, consent, or minimization. In an agent skill context, this creates a privacy and data-handling risk because user inputs and usage patterns are transmitted off-platform to an external analytics provider.

Known Vulnerable Dependency: @vitest/mocker==4.0.18 — 1 advisory(ies): CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Low

• Category: Supply Chain
• Confidence: 78% confidence
• Finding: @vitest/mocker 4.0.18 is a dev/test dependency and the cited issue is tied to mock redirection behavior that can enable path traversal or arbitrary file read in test contexts. In this lockfile, the package is present and reachable through Vitest, so the dependency finding is technically valid, but exploitability is constrained to development or CI workflows rather than runtime use of the skill.

Known Vulnerable Dependency: bn.js==4.12.2 — 1 advisory(ies): CVE-2026-2739 (bn.js affected by an infinite loop)

Low

• Category: Supply Chain
• Confidence: 74% confidence
• Finding: bn.js 4.12.2 is reported as vulnerable to an infinite loop under certain malformed inputs, creating a denial-of-service risk. The package is present transitively through cryptographic dependencies, so the finding is valid, but the practical impact depends on whether untrusted data can reach affected big-number parsing paths.

Known Vulnerable Dependency: elliptic==6.6.1 — 1 advisory(ies): CVE-2025-14505 (Elliptic Uses a Cryptographic Primitive with a Risky Implementation)

Low

• Category: Supply Chain
• Confidence: 69% confidence
• Finding: elliptic 6.6.1 is present and has an advisory related to use of a risky cryptographic primitive or implementation. Because this package is used transitively by secp256k1 and related crypto tooling, the dependency issue is real, though the lockfile alone does not show direct misuse by the skill itself.

Known Vulnerable Dependency: esbuild==0.27.3 — 1 advisory(ies): GHSA-g7r4-m6w7-qqqr (esbuild allows arbitrary file read when running the development server on Window)

Low

• Category: Supply Chain
• Confidence: 83% confidence
• Finding: esbuild 0.27.3 is flagged for arbitrary file read in development server scenarios on Windows. This is a real dependency issue, but esbuild is a dev dependency here and the risk is mostly limited to local development or CI systems running the dev server, not typical production execution of the skill.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"license": "ISC",
  "description": "",
  "dependencies": {
    "near-api-js": "^5.0.1",
    "node-fetch": "^2.7.0"
  },
  "devDependencies": {

• Confidence: 91% confidence
• Finding: The runtime dependency near-api-js is specified with a caret range, which allows automatic adoption of newer minor and patch releases. This increases supply-chain risk because a future compromised or breaking release could be installed without explicit review, which is more relevant here because this package appears to support blockchain/agent functionality and runtime dependencies directly affect deployed behavior.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"description": "",
  "dependencies": {
    "near-api-js": "^5.0.1",
    "node-fetch": "^2.7.0"
  },
  "devDependencies": {
    "@types/node": "^25.2.3",

• Confidence: 92% confidence
• Finding: The runtime dependency node-fetch is unpinned via a caret version, allowing non-explicit upgrades during install. While common in JavaScript ecosystems, this still creates avoidable supply-chain exposure if an upstream release introduces malicious code or a security regression.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"node-fetch": "^2.7.0"
  },
  "devDependencies": {
    "@types/node": "^25.2.3",
    "@types/node-fetch": "^2.6.13",
    "typescript": "^5.9.3",
    "vitest": "^4.0.18"

• Confidence: 83% confidence
• Finding: @types/node is a development-only dependency and unpinned ranges are less dangerous than runtime packages, but they still permit unreviewed dependency changes in the build environment. In CI or shared development systems, compromised tooling dependencies can affect builds or developer trust boundaries.

Static analysis

No suspicious patterns detected.