Security audit

Safe Multisig Skill

Security checks for vulnerabilities and agentic risk

Overview

This Safe wallet skill is mostly purpose-aligned, but it can sign or execute high-impact blockchain actions with weak review and endpoint safeguards.

Review this skill carefully before installing. Use it only with low-value test Safes or low-privilege signers until approval signing verifies transaction details, endpoint validation is added, dependencies are updated, and signing/execution requires an explicit human review of chain, Safe, nonce, recipient, value, calldata, and service host.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/approve-tx.ts:27
Finding: Blind Approval of an Unverified Safe Transaction Hash
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/safe_lib.ts:76
Finding: Sensitive API Credentials and Authorization Signatures Can Be Sent to Unvalidated Custom Endpoints
Content: View full analysis
', 'Safe tx-service chain slug (e.g. base, base-sepolia, mainnet)') .option('--tx-service-url ', 'Override tx-service base URL') .option('--rpc-url ', 'RPC URL (required for signing/executing)', process.env.RPC_URL) .option('--api-key ', 'Safe Transaction Service API key', process.env.SAFE_TX_SERVICE_API_KEY) .option('--debug', 'Verbose logging'); } /** * FIX SM-001 + SM-002: Resolve the transaction service URL. * Appends /api suffix and uses correct EIP-3770 short names. */ export function resolveTxServiceUrl(opts: CommonOptions): string { if (opts.txServiceUrl) return opts.txServiceUrl.replace(/\/$/, ''); if (!opts.chain) throw new Error('Missing --chain or --tx-service-url'); ``` RPC overrides are similarly returned without validation: ```ts export function resolveRpcUrl(opts: CommonOptions): string { if (opts.rpcUrl) return opts.rpcUrl; if (process.env.RPC_URL) return process.env.RPC_URL; if (opts.chain) { const url = DEFAULT_RPCS[opts.chain.toLowerCase()]; if (url) return url; throw new Error(`No default RPC URL for chain "${opts.chain}". Pass --rpc-url explicitly.`); } throw new Error('Missing --rpc-url or --chain (needed to resolve RPC URL)'); } ``` The proposal flow forwards the API key and transaction authorization material to the selected transaction service: ```ts const apiKitConfig: { chainId: bigint; txServiceUrl: string; apiKey?: string } = { chainId, txServiceUrl } ...[truncated 4765 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (78)

Known Vulnerable Dependency: vitest==4.0.18 — 2 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed); CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Critical

Category: Supply Chain
Confidence: 90% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: vitest==4.0.18 — 2 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed); CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Critical

Category: Supply Chain
Confidence: 98% confidence
Finding: This skill declares vitest v4, and the provided analysis indicates resolution to vitest 4.0.18, which is affected by critical issues including arbitrary file read and possible code execution when the Vitest UI server is exposed. Although vitest is a devDependency, exploitation can still affect developer workstations, CI runners, or test environments; in a multisig-wallet skill, compromise of those environments is especially dangerous because they may hold RPC credentials, private keys, API tokens, or transaction data.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description promises a broad Safe multisig operational skill implemented with the Safe{Core} SDK in strict TypeScript. The supplied code is instead a small shell utility whose sole purpose is to derive a Safe Transaction Service API base URL for a given chain and fetch its /v1/about/ metadata endpoint. While this is loosely related to Safe infrastructure and could support troubleshooting or service discovery, it does not implement any of the primary declared capabilities such as Safe creation, transaction proposal/confirmation/execution, nonce inspection, or pending transaction listing. The implementation language and mechanism also differ materially from the stated TypeScript SDK-based skill.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description promises a full Safe multisig transaction skill centered on Safe{Core} SDK capabilities. However, the provided code chunk is only a test suite for utility helpers. The tested behaviors are mostly configuration and validation helpers: mapping chain slugs to Safe transaction service URLs and chain IDs, resolving RPC URLs, requiring a signer private key from env vars, validating addresses and transaction hashes, warning about missing API keys, performing generic fetch-with-timeout JSON requests, and constructing CLI commands/options. These are supporting utilities, not the declared primary functionality. Since the actual code shown does not implement the core Safe operations named in the description, the description does not accurately represent this code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: There is a clear mismatch between the declared purpose and the provided code. The description claims operational Safe multisig capabilities via Safe{Core} SDK, but the code chunk is merely a Vitest configuration file for running tests. This is unrelated support tooling and does not demonstrate any of the claimed Safe-related behavior. Therefore the supplied code does not accurately represent the declared skill functionality.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.
md
| `safe-info.ts` | Fetch Safe info (owners/threshold/nonce) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.
md
| `safe-info.ts` | Fetch Safe info (owners/threshold/nonce) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.
md
| `list-pending.ts` | List pending (queued) multisig transactions |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.
md
| `list-pending.ts` | List pending (queued) multisig transactions |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.
md
| `safe_txs_list.ts` | List all multisig transactions (queued + executed) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.
md
| `propose-tx.ts` | Create + propose a multisig tx |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.
md
| `propose-tx.ts` | Create + propose a multisig tx |

Known Vulnerable Dependency: nanoid==3.3.11 — 3 advisory(ies): CVE-2026-67214 (nanoid: non-secure generators can loop indefinitely with negative size); CVE-2026-67213 (nanoid: custom generators can loop indefinitely when size is zero); CVE-2026-73086 (nanoid: Integer Overflow or Wraparound)

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: picomatch==4.0.3 — 2 advisory(ies): CVE-2026-33672 (Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Mat); CVE-2026-33671 (Picomatch has a ReDoS vulnerability via extglob quantifiers)

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: postcss==8.5.6 — 4 advisory(ies): CVE-2026-45623 (PostCSS: Arbitrary file read and information disclosure via attacker-controlled ); CVE-2026-69153 (PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappi); CVE-2026-41305 (PostCSS has XSS via Unescaped </style> in its CSS Stringify Output) +1 more

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: rollup==4.57.1 — 1 advisory(ies): CVE-2026-27606 (Rollup 4 has Arbitrary File Write via Path Traversal)

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.18.3 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: vite==7.3.1 — 5 advisory(ies): CVE-2026-39365 (Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling); CVE-2026-53571 (vite: `server.fs.deny` bypass on Windows alternate paths); CVE-2026-39363 (Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket) +2 more

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.17.1 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill documents commands that use shell execution, environment variables, and network access, but it does not declare any explicit tool scope or permissions boundaries. In an agent setting, missing scope makes it easier for the runtime to grant broader capabilities than necessary, increasing the chance of unintended command execution, secret exposure, or live blockchain interaction.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: Using npx tsx without pinning an exact package version introduces supply-chain risk because dependency resolution may pull a newer or compromised package at runtime. In a skill that handles transaction signing and environment-based secrets, executing an unexpected package version could expose private keys or alter transaction behavior.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: Using npx tsx without pinning an exact package version introduces supply-chain risk because dependency resolution may pull a newer or compromised package at runtime. In a skill that handles transaction signing and environment-based secrets, executing an unexpected package version could expose private keys or alter transaction behavior.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: Using npx tsx without pinning an exact package version introduces supply-chain risk because dependency resolution may pull a newer or compromised package at runtime. In a skill that handles transaction signing and environment-based secrets, executing an unexpected package version could expose private keys or alter transaction behavior.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: Using npx tsx without pinning an exact package version introduces supply-chain risk because dependency resolution may pull a newer or compromised package at runtime. In a skill that handles transaction signing and environment-based secrets, executing an unexpected package version could expose private keys or alter transaction behavior.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: Using npx tsx without pinning an exact package version introduces supply-chain risk because dependency resolution may pull a newer or compromised package at runtime. In a skill that handles transaction signing and environment-based secrets, executing an unexpected package version could expose private keys or alter transaction behavior.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/safe_lib.ts:77