Node of COC testnet

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:42 PM UTC
• Version:
  1.2.0

Overview

This skill is a disclosed COC blockchain node-management helper with expected local disk, process, network, and removal controls.

Install this only if you intend to operate COC nodes. Verify the npm package and any COC repo path you configure, expect persistent local disk and network activity, and use --keep-data or a backup unless you intentionally want local node data removed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill documents a destructive command (`node remove NAME --yes`) that deletes node data, but it does not explicitly warn that this may irreversibly remove blockchain state, logs, and local configuration. In an operational skill that encourages lifecycle management, omission of a clear deletion warning increases the risk of accidental data loss, especially because `--yes` suppresses interactive confirmation.

VirusTotal

59/59 vendors flagged this skill as clean.