NFT Skill - Autonomous AI Artist Agent

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:36 PM UTC
• Version: 1.0.0

Overview

This NFT automation skill matches its stated purpose, but it can spend wallet funds, post publicly, and grant broad NFT transfer permissions without enough safeguards.

Review carefully before installing. Use a dedicated low-value wallet, start on testnet, avoid storing a main wallet private key in .env, verify contract and marketplace addresses, and require manual approval before deploy, mint, list, or tweet operations. Do not rely on generated metadata unless IPFS upload success is confirmed.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: src/skills/listNFT.ts:55

Finding

Marketplace receives unrestricted operator approval for all wallet-owned NFTs

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/skills/generateArt.ts:322

Finding

IPFS upload failures are converted into fake or local metadata results

Content

View full analysis

{ try { const form = new FormData(); form.append('file', fs.createReadStream(filePath)); const res = await axios.post('https://api.pinata.cloud/pinning/pinFileToIPFS', form, { headers: { ...form.getHeaders(), pinata_api_key: process.env.PINATA_API_KEY!, pinata_secret_api_key: process.env.PINATA_SECRET! } }); return `ipfs://${res.data.IpfsHash}`; } catch (error: any) { console.error('[Art] IPFS upload failed:', error.message); return `file://${filePath}`; } } async function uploadMetadataToIPFS(metadata: any): Promise { try { const res = await axios.post('https://api.pinata.cloud/pinning/pinJSONToIPFS', metadata, { headers: { pinata_api_key: process.env.PINATA_API_KEY!, pinata_secret_api_key: process.env.PINATA_SECRET! } }); return res.data.IpfsHash; } catch (error: any) { console.error('[Art] Metadata upload failed:', error.message); return 'QmTestHash123456789'; } } ``` ### Technical Analysis Both upload functions suppress errors and return values that look usable to downstream automation: - An image-upload failure returns a local `file://` URI. That path is only meaningful on the machine that generated the image and is not available to NFT clients or buyers. - A metadata-upload failure returns the hard-coded value `QmTestHash123456789`, which is not derived from uploaded content and is presented as though it were a valid content identifier. Because these functions resolve successfully, `createAndUploadArt` returns a normal result and the CLI reports a top-level success status. The generated metadata can therefore r ...[truncated 1127 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: src/skills/mintNFT.ts:41

Finding

Unrestricted transaction retries and incorrect IPFS URI normalization can cause duplicate or malformed mints

Content

View full analysis

setTimeout(resolve, delay)); return retryWithBackoff(fn, retries - 1, delay * factor, factor); } ``` ```typescript console.log(`[Mint] Minting NFT with metadata: ipfs://${metadataUri}`); // Estimate gas first (with retry) const gasEstimate = await retryWithBackoff(async () => { return await contract.safeMint.estimateGas( wallet.address, `ipfs://${metadataUri}` ); }); console.log(`[Mint] Estimated gas: ${gasEstimate.toString()}`); // Send transaction with 20% buffer (with retry) const tx = await retryWithBackoff(async () => { return await contract.safeMint( wallet.address, `ipfs://${metadataUri}`, { gasLimit: (gasEstimate * 120n) / 100n } ); }); ``` ### Technical Analysis The retry helper calculates whether an error is retryable, but the result does not control execution. The empty conditional block is followed by an unconditional recursive retry. Reverts, invalid arguments, authorization errors, and ambiguous post-broadcast RPC failures are therefore all re ...[truncated 1824 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (94)

Known Vulnerable Dependency: handlebars==4.7.8 — 8 advisory(ies): CVE-2026-33916 (Handlebars.js has Prototype Pollution Leading to XSS through Partial Template In); CVE-2026-33937 (Handlebars.js has JavaScript Injection via AST Type Confusion); CVE-2026-33938 (Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @part) +5 more

Critical

• Category: Supply Chain
• Confidence: 90% confidence

Finding

handlebars 4.7.8 carries several critical issues including prototype pollution and template-to-code execution/XSS classes of flaws. In this lockfile it appears only in the dev/test toolchain via ts-jest, so exploitation is less likely in production, but still dangerous if untrusted templates or crafted project inputs reach the build environment.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .gitignore (reported line 3)May include surrounding context.

text

node_modules/
dist
.env
temp

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 52)May include surrounding context.

Copy .env.example to .env and fill in your values:

bash

cp .env.example .env

Required variables

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a broad autonomous NFT agent covering creation, evolution, minting, listing, sales monitoring, and promotion on Base and X/Twitter. The supplied code chunk is much narrower: it generates art, optionally via an AI image provider or procedurally, writes PNGs to disk, uploads the image and metadata to IPFS using Pinata, and returns metadata information. While this does support the 'generate' portion of the description and lightly references evolution state for art parameters, it does not perform blockchain interactions, NFT minting, marketplace operations, on-chain monitoring, or social posting. Because the actual behavior is only a subset of the declared end-to-end agent capabilities and omits several core advertised functions, this is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a broad autonomous NFT artist agent with blockchain, marketplace, monitoring, evolution, and social promotion capabilities. The supplied code implements only one narrow subset: text-to-image generation using external image APIs and local file writing. While image generation is consistent with part of the description, the primary declared behavior is much broader and includes several major capabilities not present in this code chunk. Therefore, the description overstates what this specific code actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a broad autonomous NFT agent covering art generation, minting, listing, monitoring, and promotion on Base. The supplied code chunk is much narrower: it builds prompts and sends them to LLM providers to generate short art-concept text and tweet copy. It does not generate actual artwork, interact with wallets, smart contracts, marketplaces, the Base blockchain, or Twitter/X APIs. While tweet text generation loosely supports the promotional aspect, the primary behavior of this chunk is an LLM utility module, not the end-to-end autonomous NFT agent described.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a broad autonomous AI artist agent with creative generation, evolution, marketplace, monitoring, and social promotion features. The supplied code chunk is much narrower: it is an NFT minting utility plus simple wallet/contract read helpers for the Base network. While minting NFTs is one subset of the declared purpose, the overall description materially overstates the implemented behavior. Additionally, the code accesses a private key from environment or file and signs blockchain transactions, which is a significant resource/capability not reflected in the declared permissions list.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a broad autonomous NFT artist agent covering art generation, blockchain minting/listing, sales monitoring, evolution triggers, and promotion. However, the supplied code only covers the promotion/social-media portion by posting announcements to X. That is a materially narrower and different behavior than the full declared purpose. Additionally, the code uses X/Twitter API credentials from environment variables and performs external social posting, while declared permissions are empty. Although social promotion is mentioned in the description, the code chunk does not implement the core autonomous AI artist, NFT, or blockchain behaviors described.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The supplied code chunk is only infrastructure configuration for Hardhat. It enables compiling/deploying/verifying smart contracts on Base networks via RPC URLs, private keys, and Basescan API keys. It does not implement the declared agent behaviors such as generating art, evolving art, minting NFTs, listing on marketplaces, monitoring sales, or posting to social media. While Base blockchain support is consistent with the description, the primary purpose of this code is development environment setup, which is materially different from the declared autonomous AI artist agent functionality.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description describes a feature-rich autonomous NFT art agent with blockchain, marketplace, and social media capabilities. The supplied code chunk does not implement any of those behaviors; it only configures the Jest test runner for a TypeScript Node project. This is a materially different purpose, so the description does not accurately represent the supplied code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The description presents a full autonomous NFT art agent with creative, marketplace, monitoring, and social-posting functions. The supplied code chunk does not perform those activities. Instead, it is an infrastructure script whose purpose is to deploy NFT-related contracts and persist their addresses to a local environment file. While deployment may support the broader project, this chunk’s actual behavior is materially different from the declared primary purpose, and it also writes to the filesystem, which is not reflected in the declared permissions.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a broad autonomous NFT art agent with blockchain, marketplace, and social-promotion capabilities. The supplied code chunk does not perform those actions. It contains only the evolution subsystem: local file-backed state management, theme unlocking, price calculation, and sales-threshold checks. While 'trigger artistic evolution' is part of the declared purpose and this code supports that aspect, the code’s actual behavior is much narrower and centered on local persistence and evolution rules. Because the primary functionality in this chunk materially differs from the declared end-to-end agent description, and it accesses the local filesystem rather than blockchain/social resources, this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The supplied code is limited to art generation plus IPFS upload of image and metadata. It uses an LLM for concept generation, optional AI image generation, procedural image synthesis, filesystem output, and HTTP calls to Pinata. The declared description claims a much broader autonomous NFT agent covering blockchain minting, marketplace listing, on-chain monitoring, and social promotion, none of which appear in this code chunk. While art generation is accurately represented, the description materially overstates the behavior and primary capabilities present here.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a broad autonomous NFT artist agent with blockchain, marketplace, monitoring, and social promotion capabilities. The supplied code chunk implements only a narrow image-generation utility: it calls external image APIs, decodes base64 image data, and saves a PNG file to disk. While image generation is one subset of the declared description, the actual code does not exhibit the major claimed behaviors central to the skill’s stated purpose. Therefore the description materially overstates what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a full autonomous NFT artist agent with blockchain, marketplace, monitoring, and social-posting capabilities. The provided code chunk is much narrower: it is a text-generation utility for producing an art concept and tweet text using external LLM providers. While generating art concepts and tweet copy is loosely related support functionality, the chunk does not implement the core claimed behaviors such as ERC-721 minting, marketplace interaction, on-chain monitoring, or social posting. Therefore the description materially overstates what this code actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a broad autonomous AI artist agent with capabilities spanning art creation, evolution, NFT minting, marketplace listing, sales monitoring, and social promotion. The supplied code chunk implements only a narrow subset: minting NFTs on Base and a few wallet/contract read operations. It does not generate art, evolve artwork, list NFTs, monitor sales, or interact with X/Twitter. Additionally, the code uses sensitive blockchain credentials (private key from environment or file) and performs on-chain write actions, which is notable given the declared permissions are empty. While NFT minting is consistent with part of the description, the overall declared purpose materially overstates what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a broad autonomous NFT artist agent with blockchain, marketplace, art-generation, and evolution capabilities. The supplied code does not implement those functions. It only handles one narrow promotional component: posting announcements to X/Twitter using the Twitter API. While social promotion is mentioned in the description and the specific announcement themes align with the agent narrative, the code chunk materially under-implements the declared purpose and accesses only X credentials/resources rather than blockchain or marketplace systems. Therefore the description does not accurately represent what this specific code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied code is not the autonomous NFT artist agent described. It is specifically a test suite for an evolve module, focused on local state management and business logic such as generation increments, theme unlocking, pricing, and evolution thresholds. Although 'evolution' is part of the declared description, the broader claimed capabilities—creating art, minting ERC-721 NFTs, listing assets, monitoring blockchain activity, and announcing drops—are absent from this code chunk. The code accesses mocked local filesystem resources rather than blockchain, marketplace, or social APIs, so the description materially overstates and misrepresents what this code actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a broad autonomous NFT artist agent covering generation, evolution, minting, listing, sales monitoring, and social promotion on Base. The supplied code chunk, however, is only a test suite focused on one narrow area: generating art assets and metadata and uploading them to IPFS via Pinata, with local file handling and mocked dependencies. While art generation/evolution-related behavior aligns partially with the description, the chunk does not implement or exercise the larger blockchain, marketplace, or social-media capabilities claimed. Because the primary behavior here is test code for art/IPFS functionality rather than the full declared agent, the description overstates what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a broad autonomous AI artist agent with capabilities spanning art creation, NFT minting, marketplace listing, sales monitoring, evolution logic, and social promotion. The supplied code chunk does not implement that overall behavior. It is only a test suite for listing-related functions (listNFT and checkListing) using mocked blockchain contracts. While marketplace listing is one subset of the declared description, the actual code shown is narrowly about validating listing mechanics and checking listing status, not generating art, minting NFTs, monitoring sales, evolving artwork, or posting to X/Twitter. Therefore the description materially overstates and misrepresents what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a full autonomous NFT artist agent with blockchain, marketplace, monitoring, and social promotion capabilities. The supplied code chunk does not implement those behaviors. Instead, it only contains unit tests for two LLM-related helper functions: generating art concept text and generating tweet text, using configured LLM providers and fallbacks. While tweet-generation support is loosely related to promotion and art-concept generation is loosely related to AI art creation, the primary purpose and capabilities shown here are much narrower and are test-only. There is no evidence in this chunk of Base blockchain interaction, ERC-721 minting, marketplace listing, on-chain monitoring, or autonomous orchestration. Therefore the description materially overstates what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description presents a broad autonomous AI artist agent covering creation, evolution, minting, listing, monitoring sales, and social promotion. The supplied code chunk only contains tests for minting and wallet/contract read operations. While NFT minting is consistent with one slice of the description, the primary behavior visible here is much narrower and limited to validating minting helpers. There is no evidence of AI art generation, NFT evolution, marketplace listing, sales monitoring, or Twitter/X integration. Therefore the description materially overstates and misrepresents what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a broad autonomous NFT artist agent with capabilities spanning art creation, NFT minting, marketplace listing, sales monitoring, artistic evolution, and social promotion. The supplied code chunk, however, only contains Jest tests for a monitorSales module. Its demonstrated behavior is limited to monitoring marketplace sale events for a specific NFT contract, querying recent sales, and passing normalized sale data to a callback. While sales monitoring is one stated aspect of the description, the code shown does not support the much broader primary purpose claimed. Because the actual code is narrowly scoped and lacks evidence of the other central capabilities, the description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill description advertises autonomous minting, marketplace listing, monitoring, and tweeting without prominently warning that these are high-impact external actions involving real funds, irreversible blockchain transactions, and public social-media posts. In this context, missing user warnings and consent boundaries make accidental misuse significantly more dangerous.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The skill instructs users to populate a .env file with highly sensitive credentials, including a Base private key and multiple third-party API secrets. Concentrating long-lived secrets in an environment file for an autonomous agent materially increases the blast radius if the workspace, logs, or dependent tooling are compromised.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

The user must populate a .env file with their keys:

bash

cp {baseDir}/.env.example {baseDir}/.env

Required variables: BASE_RPC_URL, BASE_PRIVATE_KEY, NFT_CONTRACT_ADDRESS,

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: dist/skills/generateArt.js:86

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: dist/skills/imageAI.js:52

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: dist/skills/llm.js:14

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: src/skills/generateArt.ts:68

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: src/skills/imageAI.ts:14

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: src/skills/llm.ts:17

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: test/llm.test.ts:61

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: test/utils/mocks.ts:27

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: test/generateArt.test.ts:136

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: test/utils/mocks.ts:10