FXAI

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:46 AM UTC
• Version: 1.0.4

Overview

Review recommended: the skill is coherent, but it can perform irreversible BNB Chain token creation and trades with a configured private key and uses unpinned install commands.

Install only if you understand that this skill can guide live BNB Chain transactions using a configured PRIVATE_KEY. Use a dedicated low-value wallet, verify every contract address and token address, review allowances before approval, avoid global installation when possible, and prefer pinned/reviewed versions of the MCP and skill tooling. Do not upload any image file that may contain private or sensitive information.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:15

Finding

Unpinned npm Packages Are Downloaded and Executed Through npx

Content

View full analysis

Vulnerability Details

File Location: README.md:15-37
Vulnerability Type: Supply-chain exposure through unpinned executable packages
Risk Level: Medium

Vulnerable Code

bash

npx @bnb-chain/mcp@latest

bash

npx skills add flapxai/fxai

Global installation is also documented:

bash

npx skills add flapxai/fxai -g

Technical Analysis

The documented commands instruct users to download and immediately execute npm packages through npx. The BNB Chain MCP command explicitly selects @latest, while the skills commands do not specify an exact package version. Consequently, the effective code executed by these commands can change after this repository has been reviewed.

These packages are not pinned by the project's package-lock.json. Integrity metadata in that lockfile therefore does not protect the packages executed by these commands. This creates a supply-chain trust boundary in which a compromised npm publisher account, malicious future release, or compromised transitive dependency could introduce arbitrary executable behavior.

The global installation option further increases exposure because it can make the installed package available beyond the current project or invocation.

Attack Path

1. An attacker compromises the npm publisher account, release process, or dependency chain of one of the referenced packages.
2. The attacker publishes a malicious version that satisfies the unpinned command, or replaces the version selected by @latest.
3. A user follows the installation instructions in README.md.
4. npx downloads and executes the malicious package with the privileges of the invoking user.
5. The malicious package accesses files, environment variables, network resources, or configuration available to that user. Because this Skill relies on an MCP environment containing a blockchain PRIVATE_KEY, sensitive wallet material could be at risk if it is exposed ...[truncated 1026 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest and all unversioned executable package references with exact, reviewed versions, for example:

   bash

   npx --yes @bnb-chain/mcp@<reviewed-exact-version>
   npx --yes skills@<reviewed-exact-version> add flapxai/fxai
   

2. Document the expected package versions and integrity hashes so users can verify downloaded artifacts.
3. Re-review packages before updating the pinned versions.
4. Prefer project-local installation over global installation to reduce scope and simplify removal.
5. Where practical, declare reviewed tooling as development dependencies and protect it with package-lock.json, then invoke the locked local binary.
6. Run installation and first execution in a restricted environment without wallet keys or unrelated credentials.
7. Do not expose PRIVATE_KEY to package installation processes. Configure sensitive MCP credentials only in the narrowly scoped runtime that requires them.
8. Consider using a dedicated low-value wallet with limited funds and permissions for this Skill.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill instructs users to run a local script that uploads a local image file and metadata to an external API, but this outbound data transfer is only briefly noted and is not reflected in the high-level skill purpose. In a wallet-connected, token-creation context, undeclared or under-emphasized exfiltration of local files and project metadata can mislead operators about what data leaves their environment.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill instructs users to run a local script that uploads a local image file and metadata to an external API, but this outbound data transfer is only briefly noted and is not reflected in the high-level skill purpose. In a wallet-connected, token-creation context, undeclared or under-emphasized exfiltration of local files and project metadata can mislead operators about what data leaves their environment.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The lockfile pins axios 1.13.6, which the provided advisory set flags for multiple issues including SSRF-related proxy bypass and prototype-pollution-driven attack chains. In a skill that performs network requests and may interact with sensitive blockchain infrastructure, a vulnerable HTTP client can increase risk of request redirection, credential leakage, or abuse of trusted outbound connections.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 88% confidence

Finding

form-data 4.0.5 is flagged for CRLF injection via unescaped multipart field names and filenames. If any part of multipart construction uses attacker-influenced values, this can enable request smuggling or malformed outbound requests to downstream services, which is especially concerning in an automation skill that may call external APIs.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.18.3 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 84% confidence

Finding

ws 8.18.3 is flagged for memory disclosure and memory-exhaustion denial of service issues. Because viem can use WebSocket transports for blockchain communication, a malicious or compromised endpoint could potentially trigger client instability, leak process memory, or cause the agent to crash during on-chain operations.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The resolved axios version is flagged with multiple advisories including SSRF and prototype-pollution-related MITM/credential theft risks. In this skill context, outbound HTTP is likely used for token metadata upload and possibly remote service interaction; combined with a required PRIVATE_KEY in the environment, compromise of request routing or response handling could expose sensitive data or influence blockchain-related operations.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The flagged form-data version has a CRLF injection advisory, which can permit malformed multipart requests or header manipulation when attacker-controlled field names or filenames are included. Because this package is used for token metadata upload, any user-supplied metadata fields, filenames, or content descriptors could become an input path for request smuggling or downstream request corruption.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to run an MCP server via npx @bnb-chain/mcp@latest, which pulls and executes the latest package version at runtime rather than a reviewed, pinned release. In this skill's context, the MCP process is expected to handle a configured PRIVATE_KEY, so a malicious or compromised upstream update could gain access to wallet-signing capability and execute unauthorized blockchain actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 79% confidence

Finding

The npx skills add flapxai/fxai installation flow executes package-resolution logic without documenting a pinned version of the skill. That creates supply-chain risk: if the package or tag is replaced, typosquatted, or otherwise compromised, users may install altered skill content that later drives transactions through an MCP configured with a private key.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 79% confidence

Finding

The global install command repeats the same unpinned npx skills add flapxai/fxai -g pattern, but with broader persistence because it affects a global skill environment. If the resolved package is malicious or compromised, it could remain available across sessions and influence future wallet-related interactions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrase is simply FXAI, with no documented scope constraints, confirmation requirements, or intent disambiguation. In a skill that can create tokens and buy or sell assets using an MCP-backed private key, an overly broad trigger increases the chance of accidental activation, prompt collision, or socially engineered invocation leading to real financial transactions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill facilitates irreversible on-chain actions including token creation, approvals, buys, and sells, yet it lacks an explicit safety warning about transaction finality, financial loss, slippage, approval risk, and the consequences of using a configured private key. In this context, omissions are especially dangerous because users may authorize real blockchain transactions and token allowances based solely on conversational prompts.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The package description and exposed scripts in this file are limited to 'upload meta' and 'find vanity salt'. That does not match the broader manifest claim that the skill creates V5 tokens and supports USDT/BNB buy and sell operations, indicating the described skill behavior is not reflected by the code artifact shown here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The package description is written only in Chinese, which imposes a specific language choice in the skill metadata without offering any alternative language or opt-in. The policy explicitly calls out language or locale constraints as violations unless the skill offers user choice or clearly documents a justified regional limitation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The file documents token-creation functions with configurable tax and fee parameters but does not warn that these choices can have lasting financial, legal, and operational consequences once deployed on-chain. Because this skill is specifically designed to create V5 tokens and is tied to a wallet private key in an MCP environment, users may be led into irreversible deployment actions without understanding that misconfiguration can create unusable, deceptive, or costly token setups.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This documentation exposes direct buy/sell contract methods for USDT and BNB, including payable BNB entrypoints and percentage-based liquidation, without any warning that transactions are irreversible, price execution may differ from user expectations, approvals may be required, and funds can be permanently lost through mistakes. In the context of an agent skill that can trigger live BNB Chain actions using a configured PRIVATE_KEY, omission of risk warnings materially increases the chance that users invoke unsafe on-chain operations through the agent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script reads an arbitrary local file path and uploads the file plus user-supplied metadata to a third-party remote API, but the CLI flow does not provide a clear runtime warning or confirmation that local contents will be transmitted off-host. In the context of a token-launching skill, operators may reasonably expect uploads, but lack of explicit disclosure increases the chance of accidental exfiltration of sensitive local files if the path is mistaken or attacker-influenced.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: follow-redirects==1.15.11 — 1 advisory(ies): CVE-2026-40895 (follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta)

Low

• Category: Supply Chain
• Confidence: 85% confidence

Finding

follow-redirects 1.15.11 is flagged for leaking custom authentication headers across cross-domain redirects. Since axios depends on this package and the skill may communicate with remote services while handling secrets or authenticated requests, redirected requests could expose tokens or other credentials to unintended hosts.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

Using a caret range for axios allows new minor/patch releases to be installed without a deliberate review, which can introduce vulnerable or behavior-changing code through the supply chain. In a skill that interacts with blockchain infrastructure and depends on a configured private key, dependency drift increases the risk of request tampering, credential leakage, or unexpected network behavior.

Content

Scanner excerpt · package.json (reported line 11)May include surrounding context.

json

"find-salt": "node scripts/find-vanity-salt.js"
  },
  "dependencies": {
    "axios": "^1.6.0",
    "form-data": "^4.0.0",
    "viem": "^2.0.0"
  }

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

Using a floating version for form-data creates avoidable supply-chain risk because the resolved package can change over time without code changes. If multipart upload logic handles attacker-influenced fields or filenames, behavior changes in this library could affect request integrity or header construction.

Content

Scanner excerpt · package.json (reported line 12)May include surrounding context.

json

},
  "dependencies": {
    "axios": "^1.6.0",
    "form-data": "^4.0.0",
    "viem": "^2.0.0"
  }
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

An unpinned viem dependency can silently pull in updated code in a package that likely handles blockchain RPC interactions, transaction building, and signing-related workflows. In the context of token creation and trading automation, such drift can affect transaction correctness or expose users to supply-chain compromise with financial impact.

Content

Scanner excerpt · package.json (reported line 13)May include surrounding context.

json

"dependencies": {
    "axios": "^1.6.0",
    "form-data": "^4.0.0",
    "viem": "^2.0.0"
  }
}

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file's comments, usage text, progress output, and error messages are written exclusively in Chinese, which imposes a specific language on users. The file does not indicate that the skill is intended only for a Chinese-speaking audience or provide any opt-in/alternative locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file’s comments and CLI usage/error messages are written only in Chinese, including the guidance shown when required arguments are missing. This creates a language policy concern because the skill does not offer users any language choice or indicate that the locale restriction is intentional and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.