NEAR Phishing Detector

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:22 PM UTC
• Version: 0.1.0

Overview

This skill is a local NEAR phishing heuristic checker with developer dependency risks but no evidence of hidden data access, persistence, exfiltration, or destructive behavior.

Before installing, update or omit dev/test dependencies where possible, especially Vitest/Vite-related tooling, and do not expose local test or dev servers to untrusted networks. Treat the detector as advisory only; it does not submit reports externally and should be paired with official NEAR verification channels.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Known Vulnerable Dependency: vitest==4.0.18 — 2 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed); CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Critical

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: vitest 4.0.18 is reported vulnerable to arbitrary file read and, in some configurations, file execution through its UI server and mocker integration. In this skill it is a testing dependency, not part of the intended runtime, which reduces direct end-user exposure, but it remains dangerous in developer/CI environments if the UI server or untrusted test assets are used.

Known Vulnerable Dependency: vitest==4.0.18 — 2 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed); CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Critical

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: The package includes vitest 4.0.18, which is flagged with critical advisories for arbitrary file read and possible code execution in Vitest-related components. Even though Vitest is a devDependency, it can still be dangerous in developer workstations, CI runners, or any environment where tests or the Vitest UI server are executed, making this a meaningful supply-chain and local-environment risk.

Known Vulnerable Dependency: nanoid==3.3.11 — 3 advisory(ies): CVE-2026-67214 (nanoid: non-secure generators can loop indefinitely with negative size); CVE-2026-67213 (nanoid: custom generators can loop indefinitely when size is zero); CVE-2026-73086 (nanoid: Integer Overflow or Wraparound)

High

• Category: Supply Chain
• Confidence: 80% confidence
• Finding: nanoid 3.3.11 is listed with denial-of-service style issues involving invalid or attacker-influenced size parameters and integer handling. In this lockfile it is transitive via tooling, so real risk depends on whether the vulnerable code paths are reachable; still, the vulnerable package version is present and could cause hangs or instability in build/dev workflows.

Known Vulnerable Dependency: picomatch==4.0.3 — 2 advisory(ies): CVE-2026-33672 (Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Mat); CVE-2026-33671 (Picomatch has a ReDoS vulnerability via extglob quantifiers)

High

• Category: Supply Chain
• Confidence: 81% confidence
• Finding: picomatch 4.0.3 is reported vulnerable to ReDoS and incorrect matching via crafted glob patterns. Because this package is commonly used for file matching in tooling, attacker-controlled glob input could consume CPU or bypass expected file-selection behavior during development or CI tasks.

Known Vulnerable Dependency: postcss==8.5.6 — 4 advisory(ies): CVE-2026-45623 (PostCSS: Arbitrary file read and information disclosure via attacker-controlled ); CVE-2026-69153 (PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappi); CVE-2026-41305 (PostCSS has XSS via Unescaped </style> in its CSS Stringify Output) +1 more

High

• Category: Supply Chain
• Confidence: 86% confidence
• Finding: postcss 8.5.6 is flagged with multiple advisories including arbitrary file read/information disclosure and XSS-related output handling. Even though it is part of build tooling, PostCSS often processes attacker-influenced styles or source maps in web projects, so vulnerable parsing or source-map handling can expose files or poison generated output in developer and CI contexts.

Known Vulnerable Dependency: rollup==4.58.0 — 1 advisory(ies): CVE-2026-27606 (Rollup 4 has Arbitrary File Write via Path Traversal)

High

• Category: Supply Chain
• Confidence: 87% confidence
• Finding: rollup 4.58.0 is reported vulnerable to arbitrary file write via path traversal. As a bundler dependency, this is most relevant during builds or plugin-driven workflows; if untrusted input influences emitted paths or plugins, it could overwrite files on developer or CI systems.

Known Vulnerable Dependency: vite==7.3.1 — 5 advisory(ies): CVE-2026-39365 (Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling); CVE-2026-53571 (vite: `server.fs.deny` bypass on Windows alternate paths); CVE-2026-39363 (Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket) +2 more

High

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: vite 7.3.1 is flagged for multiple file-read and path traversal issues in the dev server. Although this is a dev dependency, Vite's server is frequently run locally or in preview environments, and if reachable by attackers it can expose arbitrary files or bypass filesystem restrictions, making the finding more concerning than a typical inactive transitive issue.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill advertises network-capable functionality via its implementation entrypoint and phishing-check/report commands, but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. This creates a transparency and policy-enforcement gap: a host may expose or infer network access without the skill clearly declaring it, making review, sandboxing, and least-privilege enforcement harder.

Known Vulnerable Dependency: @vitest/mocker==4.0.18 — 1 advisory(ies): CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Low

• Category: Supply Chain
• Confidence: 88% confidence
• Finding: The lockfile includes @vitest/mocker 4.0.18, which is reported vulnerable to path traversal/arbitrary file read in redirect-mock handling. In this skill, it is a development/test dependency rather than production runtime code, which lowers exposure, but the dependency is still present and could be abused in local CI or developer environments if untrusted test inputs or mock configurations are processed.

Known Vulnerable Dependency: esbuild==0.27.3 — 1 advisory(ies): GHSA-g7r4-m6w7-qqqr (esbuild allows arbitrary file read when running the development server on Window)

Low

• Category: Supply Chain
• Confidence: 84% confidence
• Finding: esbuild 0.27.3 is flagged for arbitrary file read when running the development server on Windows. Here it is brought in through the frontend/tooling stack and appears limited to development use, so exploitation would generally require a developer to run the vulnerable dev server in a risky configuration.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"author": "mastrophot",
  "license": "MIT",
  "devDependencies": {
    "@types/node": "^24.3.0",
    "typescript": "^5.9.2",
    "vitest": "^4.0.0"
  }

• Confidence: 40% confidence
• Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"license": "MIT",
  "devDependencies": {
    "@types/node": "^24.3.0",
    "typescript": "^5.9.2",
    "vitest": "^4.0.0"
  }
}

• Confidence: 40% confidence
• Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"devDependencies": {
    "@types/node": "^24.3.0",
    "typescript": "^5.9.2",
    "vitest": "^4.0.0"
  }
}

• Confidence: 40% confidence
• Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.