Opensea Skill

• Outcome: Review
• Latest audit: Jul 22, 2026 · 6:46 PM UTC
• Version: 2.19.0

Overview

This OpenSea skill appears legitimate, but it should be reviewed carefully because it can execute real wallet transactions and account mutations while some write-capable flows are under-scoped and credentials are persisted locally.

Install only if you are comfortable giving an agent OpenSea API access and, for execution flows, wallet-signing authority. Use a dedicated low-balance wallet, managed signing provider with strict policies and allowlists, avoid raw private keys, review every transaction before signing, and delete or rotate cached API/auth credentials when no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 83% confidence
• Finding: The router claims broad functionality across trading, swaps, wallet configuration, MCP, and SDK surfaces, but the observed implementation appears materially narrower. This mismatch can cause users or downstream agents to place trust in capabilities, safety properties, or operational coverage that do not actually exist, increasing the chance of unsafe execution paths, misconfiguration, or accidental exposure of sensitive wallet/API operations.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The file is presented as a query/read-focused API skill, but it explicitly includes wallet-authenticated operations that mutate server-side state such as watchlist, collection settings, wallet linking, and order cancellation. This scope mismatch can cause an orchestrating agent or reviewer to grant the skill broader trust than intended, increasing the chance of unintended privileged actions.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The handoff table says tool build/register/gate actions belong to another sub-skill, yet this file documents tool-management and deployment-adjacent capabilities, including saved tool mutations and SeaDrop deployment/mint flows. That inconsistency weakens security boundaries between skills and can misroute requests into a more privileged skill than expected.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: A section labeled 'Marketplace queries (read-only)' includes `listings/opensea-listings-actions.sh`, which prepares approval/sign actions used to create listings. Mislabeling a write-enabling workflow as read-only materially increases the risk that an agent executes approval or signature steps without the elevated scrutiny normally applied to transactional operations.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The security guidance states credentials must only be set via environment variables, but earlier instructions direct storing the API key on disk in `~/.opensea/api_key`. Contradictory secret-handling guidance leads to unsafe operational assumptions, and persistent local storage increases exposure to credential theft from local compromise, backups, or multi-user environments.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README advertises NFT trading and ERC20 swap capabilities but does not clearly warn that these actions can trigger real onchain transactions that move funds or assets irreversibly. In an agent-skill context, this is more dangerous than ordinary product documentation because an integrating agent may route directly into execution-oriented sub-skills without surfacing sufficient user confirmation or risk awareness.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The wallet section describes configuring signing providers, including local private keys, without a clear warning that these credentials are highly sensitive and can authorize asset transfers if exposed or misused. In this skill ecosystem, that omission increases risk because agents may encourage setup or handling of signing material without adequate guardrails around secret storage, least privilege, or non-custodial safety practices.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This reference documents numerous state-changing endpoints such as creating listings/offers, cancelling orders, building transfer transactions, swaps, and drop deployment without prominently warning that these actions can trigger wallet signatures, asset movement, or irreversible on-chain effects. In an agent-skill context, terse API docs can be used as operational guidance for autonomous tooling, increasing the risk that an agent invokes transactional endpoints without adequate user confirmation or safety gating.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script embeds the OpenSea API key directly in the WebSocket URL query string. Although the connection uses WSS, query parameters are commonly exposed in shell history, process listings, terminal logs, proxy logs, and copy-pasted commands, so the secret may leak beyond the intended recipient. In this skill context, the script is explicitly meant for developers to run locally, which increases practical exposure because users may paste or inspect the generated command and URL during troubleshooting.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: This documentation walks users through buying, selling, offering, fulfilling, and canceling marketplace orders that result in wallet signatures and on-chain transactions, but it does not prominently warn that these actions are irreversible and can transfer NFTs or funds. In an agent-skill context, omission of that warning increases the chance an agent or user will treat these as routine API calls rather than high-risk asset-moving operations, leading to unintended financial loss.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: This section instructs the user to sign and broadcast an on-chain NFT purchase transaction, including sending ETH, without any warning that the action is irreversible and can spend real funds. In an agent-skill context, omission of explicit transaction-review guidance increases the chance of unintended purchases, wrong-chain execution, or acceptance of malicious/manipulated fulfillment data.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation presents a one-step `opensea swaps execute` flow as 'recommended' without clearly warning that it will sign and broadcast a real onchain transaction using a Privy-managed wallet. In an agent-skill context, that omission is dangerous because a user or downstream agent may treat the command as a harmless quote/demo action and unintentionally move funds or accept poor swap terms.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The file instructs users to supply `PRIVY_APP_ID`, `PRIVY_APP_SECRET`, and `PRIVY_WALLET_ID` via environment variables but does not warn that these are sensitive credentials that must be protected from logs, shell history, CI output, or prompt/tool exposure. In an AI-agent and CLI ecosystem, such secrets are commonly surfaced to subprocesses and debugging output, increasing the risk of credential leakage and unauthorized wallet operations.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script directly executes `opensea swaps execute` using caller-supplied token addresses, amount, and chain without any interactive confirmation, dry-run step, or explicit warning that the action is an on-chain swap. In this skill context, the command can trigger an irreversible blockchain transaction through whichever wallet provider is auto-detected from the environment, increasing the chance of accidental asset loss from parameter mistakes, wrong provider selection, or unintended automation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly documents usage reporting that sends verified caller wallet addresses and, for predicate-gated calls, forwards the caller's original signed EIP-3009 authorization to OpenSea analytics. Even if intended for legitimate analytics, this is security- and privacy-sensitive data sharing and the documentation does not present a prominent warning, consent requirement, or data-minimization guidance for operators or end users.

Session Persistence

Medium

• Category: Rogue Agent

Content

1. **Check the environment first.** If `OPENSEA_API_KEY` is already set and
   non-empty, use it as-is. This is the path for users who supply their own key
   — never overwrite or re-fetch it.
2. **Check disk next.** If no env var, look for a cached key at
   `~/.opensea/api_key` (override the dir with `$OPENSEA_CONFIG_DIR`). If the
   file exists and is non-empty, load it into `OPENSEA_API_KEY` and use it.

• Confidence: 94% confidence
• Finding: write or re-fetch it. 2. **Check disk next.** If no env var, look for a cached key at `~/.opensea/api_key` (override the dir with `$OPENSEA_CONFIG_DIR`). If the file exists and is non-empty, loa

Session Persistence

Medium

• Category: Rogue Agent

Content

export OPENSEA_API_KEY=$(cat "$KEY_FILE")      # 2. reuse cached key
else
  api_key=$(curl -s -X POST https://api.opensea.io/api/v2/auth/keys | jq -r '.api_key')  # 3. fetch
  mkdir -p "$(dirname "$KEY_FILE")"
  (umask 077; printf '%s\n' "$api_key" > "$KEY_FILE")  # 4. SAVE before using it
  export OPENSEA_API_KEY="$api_key"
fi

• Confidence: 96% confidence
• Finding: mkdir -p "$(dirname "$KEY_FILE")" (umask 077; printf '%s\n' "$api_key" > "$KEY_FILE") # 4. SAVE before using it export OPENSEA_API_KEY="$api_key" fi ``` ### Edge cases - **Key already exists (e

VirusTotal

VirusTotal engine telemetry is currently stale for this artifact.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: opensea-api/references/authentication.md:45