Security audit

XPR NFT (AtomicAssets)

Security checks for vulnerabilities and agentic risk

Overview

This NFT skill is mostly purpose-aligned, but it handles wallet signing and blockchain transactions with under-disclosed credentials and one write action that bypasses its stated confirmation rule.

Review before installing. Use a dedicated low-value XPR account, a restricted permission rather than active, and a trusted HTTPS RPC endpoint. Treat every write tool, including auction claiming, as a real blockchain transaction that may move assets, spend tokens, consume resources, or be irreversible.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: src/index.ts:29
Finding: Privileged Wallet Signer Trusts an Unrestricted RPC Endpoint
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: src/index.ts:1438
Finding: Auction Claim Broadcasts a Transaction Without Required Confirmation
Content: View full analysis
{ if (!auction_id) return { error: 'auction_id is required' }; try { const session = await getNftSession(); const actions = [ { account: 'atomicmarket', name: 'auctclaimbuy', authorization: [{ actor: session.account, permission: session.permission }], data: { auction_id: Number(auction_id) }, }, { account: 'atomicmarket', name: 'auctclaimsell', authorization: [{ actor: session.account, permission: session.permission }], data: { auction_id: Number(auction_id) }, }, ]; try { const result = await session.api.transact( { actions: [actions[0]] }, { blocksBehind: 3, expireSeconds: 30 } ); return { transaction_id: result.transaction_id || result.processed?.id, auction_id, claim_type: 'buyer' }; } catch { // Not the buyer — try seller claim } try { const result = await session.api.transact( { actions: [actions[1]] }, { blocksBehind: 3, expireSeconds: 30 } ); return { transaction_id: result.transaction_id || result.processed?.id, auction_id, claim_type: 'seller' }; } catch { ...[truncated 1811 chars]
Remediation: View remediation

other

Note

Location: skill.json:34
Finding: Required Wallet Credentials Are Missing From Skill Metadata
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill exposes operational guidance for NFT creation, minting, transfer, and market actions, but it does not declare an explicit tool scope such as allowed-tools or permissions. In a skill that can trigger blockchain transactions and use network-capable or environment-capable tooling, missing scope boundaries increases the risk that an agent may invoke unintended tools or broader capabilities than the skill actually requires.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The description advertises full NFT lifecycle support including minting, selling, transferring, burning, and auction flows, but it does not warn users that some operations are destructive, irreversible, or financially significant. In an agent context, this increases the risk of accidental burns, unintended listings or purchases, and irreversible asset transfers because users may treat the skill as informational rather than transactional.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This is a true issue because the tool description explicitly claims auction claiming has 'No risk' even though the handler performs authenticated on-chain write transactions using the configured private key. Mislabeling a signed financial/blockchain action as risk-free can mislead an agent or user into approving state-changing operations without appropriate caution, especially in a skill whose primary purpose is to manage NFT assets and market actions.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/index.ts:29