Opensea Skill

• Outcome: Review
• Latest audit: Oct 6, 2026 · 2:08 AM UTC
• Version: 2.26.2

Overview

The skill is a coherent OpenSea integration, but it deserves review because it can use wallet credentials to perform irreversible trades and swaps without an artifact-enforced confirmation gate.

Install only if you intend to let an agent work with OpenSea using API keys and, for writes, wallet signing credentials. Use a dedicated low-balance wallet, managed provider policies, allowlists, and per-transaction caps; avoid raw private keys; review every swap, trade, deletion, revoke, or registration before letting an agent execute it.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: opensea-swaps/scripts/opensea-swap.sh:98

Finding

Credentialed Token Swap Executes Without an Enforced Confirmation or Dry-Run Gate

Content

View full analysis

Vulnerability Details

File Location: opensea-swaps/scripts/opensea-swap.sh, lines 98–104
Vulnerability Type: Unconfirmed irreversible financial operation
Risk Level: High

Code Snippet:

bash

exec opensea swaps execute \
  --wallet-provider "$WALLET_PROVIDER" \
  --from-chain "$CHAIN" \
  --from-address "$FROM_TOKEN_ADDRESS" \
  --to-chain "$CHAIN" \
  --to-address "$TO_TOKEN_ADDRESS" \
  --quantity "$AMOUNT"

Technical Analysis

After detecting wallet-provider credentials and accepting the token, amount, chain, and provider arguments, the script directly replaces itself with opensea swaps execute. This operation can sign and submit an irreversible asset swap.

The executable path does not require an explicit execution flag, interactive confirmation, separately issued authorization token, transaction simulation, quote review, spending limit, or slippage limit. Credential validation establishes that the wallet can perform the operation, but it does not establish that the wallet owner reviewed and approved the specific transaction.

The corresponding workflow in opensea-swaps/SKILL.md documents direct execution and provides credential-safety guidance, but it does not impose a confirmation gate that the script enforces. Optional provider-side wallet policies may constrain the operation, but the script cannot rely on those policies being configured.

Attack Path

1. Wallet-provider credentials and an OpenSea API key are available in the execution environment.
2. A calling agent or automated workflow invokes opensea-swap.sh with a selected destination token, amount, chain, and optional wallet provider.
3. The script validates only that the required credentials are present.
4. Without presenting a quote or requesting transaction-specific approval, the script invokes opensea swaps execute.
5. The configured provider signs and submits the swap using the credentialed wallet.

This ...[truncated 858 chars]

Remediation

View remediation

Remediation Suggestions

• Make quote-only or dry-run behavior the default.
• Require an explicit --execute option before any signing or submission can occur.
• Before execution, display and verify the wallet address, source and destination assets, amount, recipient, chains, expected output, minimum output, fees, route, approvals, and slippage.
• Require interactive confirmation for terminal use. For non-interactive automation, require a separately generated, short-lived confirmation token bound to the exact transaction parameters.
• Enforce configurable maximum transaction values, slippage limits, token allowlists, recipient allowlists, and chain allowlists in the executable path.
• Simulate the transaction and reject it if the actual calldata, recipient, value, approvals, or expected asset movement differs from the reviewed quote.
• Encourage provider-side spending and recipient policies as defense in depth, without treating them as a substitute for transaction-specific consent.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (108)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CHANGELOG.md (reported line 164)May include surrounding context.

md

### Minor Changes

- ef89be8: `opensea-api`: add `references/authentication.md` covering SIWE wallet authentication — getting a token via the SDK (`OpenSeaAuth`) or the CLI `auth` commands (login, status, refresh, revoke, tokens, scopes), available scopes, and manual cURL flows. Document auth scopes in `references/rest-api.md`.
- d4dff85: `opensea-tool-sdk`: update SKILL.md and `references/predicate-gating.md` for the unified 402 + X-Payment flow and the new `paidPredicateGate` (single 402 round trip for combined identity + payment). Remove the `--auth eip3009` flag from `pay` command docs.

## 2.14.0

Self-Modification

High

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · CHANGELOG.md (reported line 205)May include surrounding context.

md

### Minor Changes

- ef89be8: `opensea-api`: add `references/authentication.md` covering SIWE wallet authentication — getting a token via the SDK (`OpenSeaAuth`) or the CLI `auth` commands (login, status, refresh, revoke, tokens, scopes), available scopes, and manual cURL flows. Document auth scopes in `references/rest-api.md`.
- d4dff85: `opensea-tool-sdk`: update SKILL.md and `references/predicate-gating.md` for the unified 402 + X-Payment flow and the new `paidPredicateGate` (single 402 round trip for combined identity + payment). Remove the `--auth eip3009` flag from `pay` command docs.

## 2.14.0

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md

Entry point for OpenSea agent skills. Pick the sub-skill based on task, then read its `SKILL.md`:

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md

Entry point for OpenSea agent skills. Pick the sub-skill based on task, then read its `SKILL.md`:

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md

| Query NFT/token data, search, drops, events | [`opensea-api/SKILL.md`](opensea-api/SKILL.md) |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md

| Query NFT/token data, search, drops, events | [`opensea-api/SKILL.md`](opensea-api/SKILL.md) |

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · docs/policy-administration.md (reported line 106)May include surrounding context.

md

## After any change

Run `opensea wallet info` on the agent host. The output should reflect the new posture (no warnings, or only the static "verify scope at console" reminder for Fireblocks/Bankr). If a warning persists, the change did not land — re-check the dashboard.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 86% confidence

Finding

The skill exposes a state-changing delete operation for saved tools using caller-supplied identifiers. In an agent environment, if untrusted input can influence these parameters or if the write-capable token is over-scoped, an attacker could cause unauthorized removal of a user's saved tools or curated state.

Content

Scanner excerpt · opensea-api/SKILL.md (reported line 409)May include surrounding context.

|---|---|---| | List saved tools | opensea tools saved list [--toolkit-name <name>] | opensea api request GET /api/v2/saved-tools --params '{"toolkit_name":"<name>","limit":10}' | | Save a tool | opensea tools saved save <registry_chain> <registry_addr> <tool_id> [--toolkit-name <name>] | opensea api request POST /api/v2/saved-tools --body saved-tool.json | | Remove a saved tool | opensea tools saved remove <registry_chain> <registry_addr> <tool_id> [--toolkit-name <name>] | opensea api request DELETE /api/v2/saved-tools --params '{"tool_id":"<id>","registry_chain":"<chain>","registry_addr":"<addr>"}' |

bash

# List saved tools

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 89% confidence

Finding

The skill includes DELETE /api/v2/accounts/agent, which can withdraw an agent declaration for the authenticated wallet. Because this is a destructive state change inside a broadly described API skill, parameter/control-flow abuse or mistaken invocation could alter public account relationships without the user intending it.

Content

Scanner excerpt · opensea-api/SKILL.md (reported line 435)May include surrounding context.

md

| Task | CLI Command | Alternative |
|---|---|---|
| Declare self an agent | `opensea agent declare` | `opensea api request PUT /api/v2/accounts/agent` |
| Withdraw the declaration | `opensea agent withdraw` | `opensea api request DELETE /api/v2/accounts/agent` |
| Propose a relationship | `opensea agent propose <address> --role AGENT\|OWNER` | `opensea api request POST /api/v2/accounts/agent-relationships --body propose.json` |
| Confirm a proposal | `opensea agent confirm <address> --role AGENT\|OWNER` | `opensea api request POST /api/v2/accounts/agent-relationships/confirm --body confirm.json` |
| Withdraw or revoke | `opensea agent revoke <address> --role AGENT\|OWNER` | `opensea api request DELETE /api/v2/accounts/agent-relationships --params '{"counterparty_address":"0x...","caller_role":"AGENT"}'` |

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

This endpoint revokes agent relationships based on supplied counterparty parameters and caller role, making it a meaningful write primitive. In a prompt-influenced agent, untrusted input could steer the action toward unwanted relationship deletion, impacting account metadata and trust signals tied to the wallet.

Content

Scanner excerpt · opensea-api/SKILL.md (reported line 438)May include surrounding context.

md

| Withdraw the declaration | `opensea agent withdraw` | `opensea api request DELETE /api/v2/accounts/agent` |
| Propose a relationship | `opensea agent propose <address> --role AGENT\|OWNER` | `opensea api request POST /api/v2/accounts/agent-relationships --body propose.json` |
| Confirm a proposal | `opensea agent confirm <address> --role AGENT\|OWNER` | `opensea api request POST /api/v2/accounts/agent-relationships/confirm --body confirm.json` |
| Withdraw or revoke | `opensea agent revoke <address> --role AGENT\|OWNER` | `opensea api request DELETE /api/v2/accounts/agent-relationships --params '{"counterparty_address":"0x...","caller_role":"AGENT"}'` |
| List your own relationships | `opensea agent list` | `opensea api request GET /api/v2/accounts/agent-relationships` |
| Read a public profile | `opensea agent profile <address_or_username>` | `opensea-agent-relationships.sh <address_or_username>` |

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · opensea-api/references/authentication.md (reported line 11)May include surrounding context.

md

|---|---|---|
| API key | Application access and quota | `X-API-KEY` on REST and MCP requests |
| SIWE session | Create, list, rotate, or revoke PATs | Session cookies; managed by the CLI or SDK |
| Scoped personal access token (PAT) | Durable credential used only to mint JWTs | Token exchange only |
| Wallet JWT | Short-lived wallet identity and scopes | `Authorization: Bearer <JWT>` on REST and MCP requests |

Wallet-scoped REST and MCP calls need both the API key and wallet JWT. Never send a PAT to either surface.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

This markdown file advertises buying/selling NFTs, executing token swaps, setting up wallet signing, and registering onchain tools, but it does not include any caution that these actions can move funds, require signatures, incur fees, or have irreversible onchain effects. Under the markdown-specific SQP-2 criteria, descriptions of behaviors that may affect user data, privacy, or system integrity should include explicit warnings.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill routes to sub-skills that explicitly cover networked API access, shell-based workflows, wallet configuration, trading, and token swaps, but the top-level manifest does not declare any tool-scope restrictions such as allowed tools or permissions. In an agent environment, this creates an overly broad trust boundary: a model may invoke shell or network capabilities without an explicit least-privilege contract, increasing the chance of unintended external calls or transaction-related actions once downstream instructions are followed.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · docs/policy-administration.md (reported line 28)May include surrounding context.

md

const ownerKey = process.env.PRIVY_OWNER_PRIVATE_KEY!

const policyIds = ["pol_abc123"] // policy you authored separately
const url = `https://api.privy.io/v1/wallets/${walletId}`
const body = { policy_ids: policyIds }

const signature = generateAuthorizationSignature({

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · opensea-wallet/references/wallet-setup.md (reported line 35)May include surrounding context.

md

const ownerKey = process.env.PRIVY_OWNER_PRIVATE_KEY!

const policyIds = ["pol_abc123"] // policy you authored separately
const url = `https://api.privy.io/v1/wallets/${walletId}`
const body = { policy_ids: policyIds }

const signature = generateAuthorizationSignature({

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · opensea-wallet/references/wallet-setup.md (reported line 94)May include surrounding context.

md

const ownerKey = process.env.PRIVY_OWNER_PRIVATE_KEY!

const policyIds = ["pol_abc123"] // policy you authored separately
const url = `https://api.privy.io/v1/wallets/${walletId}`
const body = { policy_ids: policyIds }

const signature = generateAuthorizationSignature({

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is presented as an API/query-focused capability, but it also includes wallet-scoped write operations such as profile, collection, drop, tool, and agent-account changes. That scope mismatch increases the chance that a caller or orchestrator treats the skill as read-only and invokes it in contexts where side effects were not expected or sufficiently approved.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The document frames marketplace functionality as read-only while also including authenticated order-cancellation and other write operations under the same skill scope. This inconsistency can mislead agents and users about the actual authority exposed, increasing the risk of unintended destructive actions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

The skill instructs agents to persist an API credential to ~/.opensea/api_key for reuse across sessions. Even with mode 600, session persistence increases the blast radius of local compromise, accidental credential reuse in other contexts, and unintended multi-tenant leakage on shared hosts or agent runners.

Content

Scanner excerpt · opensea-api/SKILL.md (reported line 93)May include surrounding context.

md

1. **Check the environment first.** If `OPENSEA_API_KEY` is already set and
   non-empty, use it as-is. This is the path for users who supply their own key
   — never overwrite or re-fetch it.
2. **Check disk next.** If no env var, look for a cached key at
   `~/.opensea/api_key` (override the dir with `$OPENSEA_CONFIG_DIR`). If the
   file exists and is non-empty, load it into `OPENSEA_API_KEY` and use it.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 81% confidence

Finding

The example explicitly writes the fetched API key to a predictable file on disk before use. Plaintext token caching can expose credentials to local compromise, backups, misconfigured home-directory sharing, or later unintended use by other tools running under the same account.

Content

Scanner excerpt · opensea-api/SKILL.md (reported line 124)May include surrounding context.

md

export OPENSEA_API_KEY=$(cat "$KEY_FILE")      # 2. reuse cached key
else
  api_key=$(curl -s -X POST https://api.opensea.io/api/v2/auth/keys | jq -r '.api_key')  # 3. fetch
  mkdir -p "$(dirname "$KEY_FILE")"
  (umask 077; printf '%s\n' "$api_key" > "$KEY_FILE")  # 4. SAVE before using it
  export OPENSEA_API_KEY="${api_key}"
fi

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence

Finding

The skill recommends executing npx @opensea/cli without pinning a version or integrity hash, which allows the latest package version to be fetched at runtime. If the package is compromised, unpublished/republished, or a breaking release introduces unsafe behavior, an agent could execute unreviewed code with access to local environment variables and credentials.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: opensea-api/references/authentication.md:45

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: opensea-wallet/references/wallet-setup.md:295