Nla Arbitrate

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:01 PM UTC
• Version: 1.0.0

Overview

The skill is coherent and not malicious, but it controls irreversible blockchain arbitration decisions and documents risky credential and install practices that deserve review before use.

Review this skill carefully before installing. Prefer interactive arbitration first, avoid auto mode for all escrows unless you fully trust the model and inputs, use environment variables or a secrets manager instead of API-key flags, and install the nla CLI from a verified, pinned source in a least-privileged environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Global npm Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippet:

yaml

compatibility: Requires nla CLI installed (npm install -g nla). Requires a funded Ethereum wallet whose address matches the oracle specified in escrows.

Technical Analysis

The documentation directs users to install the nla package globally from npm without specifying an exact version, package integrity value, or verified source. Consequently, the command resolves to whichever package release is associated with the latest applicable npm tag at installation time rather than to a version reviewed alongside this Skill.

npm packages can execute code through installation lifecycle scripts and installed command-line entry points. If the package, its maintainer account, or one of its transitive dependencies is compromised, a user following this instruction could execute attacker-controlled code. Global installation also increases exposure because the executable is made available system-wide for the installing user.

The repository contains no bundled malicious scripts, and the audited instruction does not itself prove that the current nla package is malicious. The vulnerability is the absence of dependency pinning and integrity or provenance controls in a security-sensitive workflow involving Ethereum wallet credentials and LLM API keys.

Attack Path

1. An attacker compromises the nla npm package, a maintainer account, or a transitive dependency, or publishes a malicious future release through the package's distribution channel.
2. The malicious release becomes the version selected by the unpinned npm install -g nla command.
3. A user follows the prerequisite instruction and globally installs the package.
4. Attacker-controlled code executes through an npm lifecycle script or when the user invokes the installed nla executable.
5. The ma ...[truncated 1204 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the floating installation command with an exact, reviewed version, such as npm install -g nla@<approved-version>.
2. Document the package's official npm namespace, publisher, source repository, and expected provenance so users can verify that they are installing the intended package.
3. Verify package integrity and signatures where supported. Record the reviewed package artifact's checksum or npm integrity metadata in release documentation.
4. Review and pin transitive dependencies through a lockfile in a controlled local installation rather than relying on an unconstrained global installation.
5. Prefer a project-local installation invoked through a pinned package script or an independently verified binary. Avoid elevated installation privileges.
6. Audit lifecycle scripts before installation and consider installing with lifecycle scripts disabled when they are not required.
7. Execute the CLI in an isolated, least-privileged environment with only the credentials needed for the immediate operation.
8. Avoid passing private keys or API keys directly on the command line, and ensure secrets are not exposed to unrelated processes or retained in shell history.
9. Establish a dependency-update process in which new versions are reviewed and tested before the documented pin is changed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill recommends --auto mode for arbitration without emphasizing at that point that the action results in permanent on-chain attestations and gas-spending transactions. Because the arbitration decision is delegated to an LLM and then submitted on-chain, a user may trigger irreversible approvals or rejections without fully appreciating the finality or the trust placed in the model.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill advises supplying LLM API keys via CLI flags without warning that command-line arguments can be exposed through shell history, terminal logs, audit tooling, or process listings visible to other local users. This creates a realistic credential leakage path that could allow unauthorized use of paid API accounts or access to associated data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The example command embeds an API key directly on the command line (sk-...), normalizing an unsafe practice that can leak secrets into shell history, copied transcripts, CI logs, and process inspection tools. In the context of a blockchain arbitration skill, compromise of the API key could also let an attacker abuse the auto-arbitration integration or incur API charges.

Content

No source excerpt is available for this finding.