T03 · Remote Payload Retrieval and Execution
Error
- Location
references/foundry.md:6- Finding
Remote Installer Is Downloaded and Executed Without Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
Web3 Docs
Security checks for vulnerabilities and agentic risk
Overview
This Web3 documentation skill is mostly purpose-aligned, but it includes copyable commands that can execute remote code or move real blockchain assets without enough safety framing.
Review this skill before installing. It is not malicious on inspection, but do not blindly copy its installer, deployment, transfer, or private-key examples. Prefer verified installers, testnets or local chains, wallet confirmation flows, pinned package versions, and carefully checked recipient addresses, network IDs, and amounts.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/fetch-docs.js:75- Finding
Documentation Fetcher Allows Cross-Origin Redirects and HTTPS Downgrade
- Content
View full analysis
{ if (redirectCount > 5) return reject(new Error('Too many redirects')); const parsedUrl = new URL(targetUrl); const lib = parsedUrl.protocol === 'https:' ? https : http; const options = { hostname: parsedUrl.hostname, path: parsedUrl.pathname + parsedUrl.search, headers: { 'User-Agent': 'Mozilla/5.0 (compatible; web3-docs-fetcher/1.0)', 'Accept': 'text/html,application/xhtml+xml', }, }; const timer = setTimeout(() => { req.destroy(); reject(new Error(`Request timed out after 15s fetching ${targetUrl}`)); }, 15000); const req = lib.get(options, res => { // Follow redirects if (res.statusCode === 301 || res.statusCode === 302 || res.statusCode === 307 || res.statusCode === 308) { clearTimeout(timer); const location = res.headers.location; if (!location) return reject(new Error('Redirect with no Location header')); // Handle relative redirects const nextUrl = location.startsWith('http') ? location : new URL(location, targetUrl).href; res.resume(); return fetchPage(nextUrl, redirectCount + 1).then(resolve).catch(reject); } ``` ### Technical Analysis The initial documentation URLs are selected from a fixed source map, but the redirect handler does not preserve that trust boundary. A permitted source can redirect the request to any hostname, and the code explicitly supports both HTTPS and plaintext HTTP. The expression selecting `http` for any protocol other than `https:` means an HTTPS source can redirect to an HTTP endpoint. Traffic to that endpoint is not protected against network interception or modificat ...[truncated 1793 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (26)
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 98% confidence
- Finding
curl -L https://foundry.paradigm.xyz | bashis a direct external script fetch and execution pattern. In a skill meant to provide actionable command-line guidance, this is more dangerous than passive reference text because it encourages immediate execution of network-fetched code, creating a meaningful supply-chain compromise path.- Content
Project Setup
bash curl -L https://foundry.paradigm.xyz | bash && foundryup forge init my-project && cd my-project
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
│ └── MyToken.ts ├── hardhat.config.ts ← main config ├── package.json └── .env ← RPC URLs, private keys (never commit)
text ## hardhat.config.ts
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
│ └── MyToken.ts ├── hardhat.config.ts ← main config ├── package.json └── .env ← RPC URLs, private keys (never commit)
text ## hardhat.config.ts
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
│ └── MyToken.ts ├── hardhat.config.ts ← main config ├── package.json └── .env ← RPC URLs, private keys (never commit)
text ## hardhat.config.ts
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger description is overly broad because it includes a catch-all for essentially any EVM or blockchain development question, which can cause the skill to activate outside its narrowly intended scope. Over-broad activation increases the chance that this skill unnecessarily overrides more appropriate skills or injects external-doc-fetching guidance into unrelated contexts, expanding the attack surface for misuse or prompt-routing errors.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown reference includes write-contract and ETH transfer examples that can spend funds or change blockchain state, but it does not include any accompanying warning that these actions are irreversible and should be verified before use. Because this is a markdown file, the applicable check is whether the description warns about behaviors affecting user data, privacy, or system integrity; here, financial/system-impacting behavior is shown without such disclosure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation instructs users to pipe a downloaded script directly into
bash, which executes remote code without prior inspection. Even if this is a common install pattern, it creates supply-chain and command-execution risk if the remote content, transport path, or hosting account is ever compromised.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The reference includes
forge script ... --broadcast --verifyandcast send ... --private-key $KEY, which can cause real on-chain state changes and spend funds if copied into a live environment. In a documentation skill for web3 developers, users are especially likely to paste commands directly, so the lack of warnings about mainnet usage, wallet selection, private key handling, and asset loss makes this a real safety issue.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md network: "base", chainId: 8453, urls: { apiURL: "https://api.basescan.org/api", browserURL: "https://basescan.org", }, },
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The example shows constructing an account directly from
process.env.PRIVATE_KEYwithout any accompanying warning about secret handling, storage, or exposure risks. In a web3 documentation skill, readers may copy this pattern into scripts, CI jobs, or even frontend code, increasing the chance of private key leakage and compromise of wallet funds.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The examples perform state-changing blockchain operations such as token transfers and ETH sends without clearly warning that these actions are irreversible and may spend real assets if pointed at a live network. In EVM development docs, users often paste examples directly, so omission of side-effect warnings raises the risk of accidental mainnet transactions, asset loss, or unintended contract interactions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file includes 'Write Contract' and 'Send ETH' examples that initiate token transfers and ETH transfers, but it does not include any warning that these actions can move funds, incur gas fees, or have irreversible on-chain effects. For markdown files, SQP-2 applies when the skill description omits warnings about behaviors that could affect user data, privacy, or system integrity; here the omitted disclosure concerns direct financial/system-impacting actions.
- Content
Static analysis
Detected: suspicious.generated_source_template_injection
User-controlled placeholder is embedded directly into generated source code.
Critical
- Code
- suspicious.generated_source_template_injection
- Location
- references/foundry.md:109