Security audit

Prism Scanner

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed token-risk scanner that calls a PRISM API, with some quality and privacy cautions but no evidence of hidden, destructive, or persistence behavior.

Install only if you are comfortable sending token symbols or contract addresses to the configured PRISM service. Prefer explicit scan requests, review JSON output carefully if using it in automation, and treat results as advisory rather than financial advice.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/scan.sh:40
Finding: Unescaped Attacker-Controlled Data in JSON and Terminal Output
Content: View full analysis
Remediation: View remediation
/dev/null 2>&1 <<<"$analyze"; then echo "Error: invalid analysis response" >&2 exit 1 fi ``` Apply equivalent validation to `copycat`. 3. Validate input according to supported formats. Permit only expected token-symbol characters or recognized EVM/Solana address formats, and impose a reasonable maximum length. 4. Remove non-printable control characters before displaying user-controlled or remote text. Alternatively, render such characters in an escaped representation rather than sending them directly to a terminal. 5. Validate response field types and ranges. In particular, require `risk_score` and `similarity` to be numeric and constrain risk scores to the documented range before numeric comparisons. 6. Use explicit `curl` failure handling, timeouts, and HTTPS-only behavior, such as `--fail --show-error --max-time`, and terminate safely if an API request or response validation fails. ]]>

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The documented behavior does not cleanly match the actual capability surface: it relies on a remote API for security judgments and includes additional analysis functions beyond the narrow description. This mismatch is dangerous because agents and users may trust the skill as a local deterministic checker while it can transmit user-supplied token data to an external service and produce opaque results that were not fully disclosed.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill advertises shell-based usage (./scan.sh ...) but does not declare any explicit tool scope or permissions boundaries. In an agent setting, undeclared shell capability increases the chance that a host runtime grants broader execution than reviewers expect, enabling command execution or unsafe parameter handling through the wrapper script.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger set includes very generic phrases such as "check {token}" and "analyze {token}", which can match ordinary user requests and cause the skill to run when the user did not explicitly intend a token-security scan. In an agent environment, unintended invocation can misroute user intent, cause unnecessary external API calls, and expose token/user-provided inputs to the configured third-party service.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.