Security audit

Nla Create

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but it asks agents to handle blockchain wallet operations in ways that can expose private keys or create unsafe transactions.

Review this skill carefully before installing. Use a dedicated low-value wallet, avoid pasting private keys into chat or command lines, verify the nla package source and version, and independently confirm the network, token, amount, oracle, and transaction details before signing.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:7
Finding: Unpinned Globally Installed Third-Party CLI
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:39
Finding: Private Key Exposure Through Command-Line Arguments
Content: View full analysis
` - Pass `--private-key ` to the command - Set the `PRIVATE_KEY` environment variable ``` ### Technical Analysis The documentation recommends passing a wallet private key directly as a command-line argument. Command-line arguments can be retained in shell history, terminal recordings, automation logs, agent transcripts, crash reports, and process-monitoring systems. Depending on the operating system and process permissions, other local users or processes may also be able to inspect the command line while it is running. The environment-variable alternative is safer than a literal shell argument in some environments but remains sensitive. Environment variables can be inherited by child processes, exposed through debugging or diagnostic output, captured by CI systems, or unintentionally written to logs. A blockchain private key is a bearer credential. Disclosure allows an attacker to sign transactions without further authentication, and blockchain transfers are generally irreversible. ### Attack Path 1. A user follows the documented example and enters `nla wallet:set --private-key ` or supplies the key to another CLI command. 2. The plaintext key is stored in shell history, captured in a tool transcript, exposed in a process listing, or collected by terminal or CI logging. 3. An attacker with access to that history, log, transcript, or process metadata extracts the key. 4. The attacker imports the key into another wallet or signing utility. 5. The attacker signs unauthorized token approvals or transfers and moves assets to an attacker-controlled address. For the environment-variable variant, an attacker may instead obtain the k ...[truncated 630 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:56
Finding: Shell Command Injection Through Unescaped Escrow Parameters
Content: View full analysis
" \ --amount \ --token \ --oracle \ [--arbitration-provider ""] \ [--arbitration-model ""] \ [--arbitration-prompt ""] ``` ### Technical Analysis The skill directs an agent to insert user-controlled values into a Bash command template. The demand and arbitration prompt are unrestricted natural-language strings. Placing them between literal double quotes does not make arbitrary shell content safe: embedded quote characters can terminate the intended argument, and shell constructs such as command substitution may be evaluated when a generated command is interpreted by Bash. The amount, address, provider, and model fields also require strict validation. If the implementation constructs one command string and passes it to a shell, metacharacters in any insufficiently validated field may alter command structure, add arguments, redirect output, or execute additional commands. The declared `Bash(nla:*)` restriction does not by itself eliminate this risk. A tool policy that authorizes a command based only on its visible prefix may still permit shell syntax appended after or embedded within the arguments. ### Attack Path 1. An attacker supplies a crafted demand or arbitration prompt containing quote-breaking text and shell syntax. 2. The agent substitutes that text directly into the documented Bash template. 3. The generated string is executed by a shell rather than passed to the CLI as a structured argument array. 4. The malicious text escapes the intended argument boundary or triggers shell command substitution. 5. Bash executes an attacker-selected command with the agent process's local privileges. 6. The command can r ...[truncated 768 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly instructs the user to supply a private key via command line flag or environment variable without a prominent warning about credential exposure. Passing private keys on the CLI can leak them through shell history, process listings, terminal logs, agent transcripts, or tool telemetry, which is especially dangerous here because the key controls blockchain funds and can enable irreversible asset theft.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.