OK Computers + Ring Gates + Net Protocol

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:26 AM UTC
• Version: 2.2.0

Overview

The skill has a coherent blockchain-toolkit purpose, but it includes unsafe remote page loading and powerful transaction/signing workflows that need careful review before installation.

Install only if you are comfortable with a blockchain tool that can prepare and submit permanent public onchain writes. Keep BANKR_API_KEY tightly scoped and do not let an agent submit or sign transactions without reviewing the exact destination, calldata, value, chain, and content. Avoid deploying or visiting net-loader.html as written unless the relay and stored content are trusted and isolated, because it can execute mutable remote/onchain HTML in the page context.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: net-loader.html:35

Finding

<![CDATA[Mutable Remote Code Execution Through JSONP and Untrusted Onchain HTML]]>

Content

View full analysis

` element whose source is a mutable, external ...[truncated 2948 chars]

Remediation

View remediation

` element. Retrieve it as non-executable data through a controlled API or a narrowly scoped same-origin backend. 3. Authenticate retrieved content before use: - Require a signature from an explicitly trusted publisher. - Bind the signature to the chain ID, contract, key, operator, content hash, and version. - Reject content whose signer or expected hash is not preconfigured. 4. Do not pass untrusted HTML to `document.write()`. Render plain content through `textContent`. 5. If HTML rendering is required, place it in a separate sandboxed iframe without `allow-scripts`, `allow-same-origin`, forms, popups, top navigation, or wallet access. 6. Apply a restrictive Content Security Policy that disallows inline script, event handlers, arbitrary remote scripts, and unexpected network destinations. 7. Pin and independently verify any relay implementation and deployment. A source-code repository reference is not sufficient to authenticate the deployed endpoint. 8. Clearly document that blockchain data is public and untrusted, regardless of whether it passes an integrity hash check. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: medina-dashboard.html:882

Finding

<![CDATA[Stored DOM Cross-Site Scripting in the Medina Dashboard]]>

Content

View full analysis

No fleet nodes found'; return; } const roles = { 0: 'Gateway (Rocinante)' }; panel.innerHTML = fleet.map((node, i) => { if (node.error) { return `

#${node.tokenId}Error: ${node.error}

`; } const channelInfo = Object.entries(node.channels).map(([ch, info]) => `${ch.split('_').pop()}: ${info.count} msgs` ).join(', ') || 'No RG channels'; return `

#${node.tokenId} ${node.username} ${roles[i] || 'Fleet Node'}

`; }).join(''); } function renderTransmissions(txs) { const panel = document.getElementById('txPanel'); if (txs.length === 0) { panel.innerHTML = '

No transmissions detected

'; return; } panel.innerHTML = txs.map(tx => `

TX:${tx.txid} ${formatBytes(tx.size)}

${tx.type} ${tx.chunks} chunks ${tx.sharded ? 'SHARDED' : 'SINGLE'} ${tx.hash ? tx.hash.slice(0, 12) + '...' : ''}

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: okcomputer.js:34

Finding

<![CDATA[Hardcoded Third-Party Alchemy RPC Credential]]>

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (39)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md

- **The `okcomputer.js` helper library** (included in this project)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · medina-dashboard.html (reported line 464)May include surrounding context.

html

<body>

<div class="container">
  <!-- Header -->
  <div class="header">
    <h1>MEDINA STATION</h1>
    <div class="subtitle">Ring Gates Network Monitor &mdash; OK Computers Inter-System Protocol</div>

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Although framed as loading content, the implementation decodes remote data and, when it looks like HTML, replaces the current document via document.open/document.write/document.close. That means untrusted remote data is not merely displayed but executed as active HTML/JS in the page context, enabling arbitrary script execution, credential theft, UI spoofing, or full takeover of the skill's interface.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill fetches remote content and injects it into the live document without any warning, consent, or trust boundary. This creates a silent remote-code/content execution path where users cannot distinguish built-in UI from attacker-controlled UI, making phishing, malicious redirects, and deceptive prompts much easier.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README explicitly recommends bypassing iframe sandbox restrictions through a JSONP relay, which weakens an intended isolation boundary and introduces script-injection and trust-on-relay risks. In this skill context, agents may use the loader to render arbitrary onchain HTML, so a compromised relay or malicious stored content could execute attacker-controlled code in the page context and expose wallet-connected or agent-controlled interactions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

L188 states that the sandbox blocks 'all network requests' and specifically 'no external scripts.' However, L124-L131 explicitly describe net-loader.html using a <script src=...> JSONP relay to fetch remote data, which depends on external script loading being allowed. This is an active contradiction in the documentation about the platform's effective capabilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The specification exposes a deploy command that assembles content from onchain messages and publishes it to a page, but the documentation does not warn that this changes published state or that assembled content may originate from public, potentially untrusted channels. In a protocol centered on reconstructing and deploying blockchain-sourced content, omission of confirmation, provenance checks, and safety warnings increases the chance of accidental defacement or publishing malicious HTML/JS.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill claims there are 'No servers. No external dependencies,' but later relies on Bankr APIs and a JSONP relay for core workflows. This is dangerous because it misrepresents the trust boundary and may cause an agent or operator to treat third-party services as unnecessary or safe when they are actually critical external dependencies handling API keys, transaction submission, and content loading.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The curl example sends a Bankr API key and transaction payload to an external endpoint. This is risky because shell-based examples can encourage unsafe handling of secrets in logs, shell history, process listings, or copied command transcripts while also delegating onchain execution to a third party.

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

Submit using Bankr's direct API (recommended — synchronous, instant):

bash

curl -s -X POST https://api.bankr.bot/agent/submit \
  -H "X-API-Key: $BANKR_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"transaction\": $(echo $TX_JSON)}"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The curl example sends a Bankr API key and transaction payload to an external endpoint. This is risky because shell-based examples can encourage unsafe handling of secrets in logs, shell history, process listings, or copied command transcripts while also delegating onchain execution to a third party.

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

Submit using Bankr's direct API (recommended — synchronous, instant):

bash

curl -s -X POST https://api.bankr.bot/agent/submit \
  -H "X-API-Key: $BANKR_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"transaction\": $(echo $TX_JSON)}"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

This skill instructs sending Bankr API keys and transaction objects to an external service via fetch. That is dangerous because the external service becomes a trusted signing/submission intermediary, and any misuse, compromise, or misconfiguration could expose secrets or cause unauthorized onchain actions with real financial impact.

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

Or submit using Node.js fetch (no shell commands):

javascript

const res = await fetch("https://api.bankr.bot/agent/submit", {
  method: "POST",
  headers: {
    "X-API-Key": process.env.BANKR_API_KEY,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

This skill instructs sending Bankr API keys and transaction objects to an external service via fetch. That is dangerous because the external service becomes a trusted signing/submission intermediary, and any misuse, compromise, or misconfiguration could expose secrets or cause unauthorized onchain actions with real financial impact.

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

Or submit using Node.js fetch (no shell commands):

javascript

const res = await fetch("https://api.bankr.bot/agent/submit", {
  method: "POST",
  headers: {
    "X-API-Key": process.env.BANKR_API_KEY,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The API reference explicitly recommends external transaction submission to Bankr, which creates a strong trust dependency for transaction integrity and availability. If the endpoint, credentials, or surrounding environment are compromised, users may submit malicious or altered transactions with irreversible onchain consequences.

Content

Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.

Submit a Transaction

bash

curl -s -X POST https://api.bankr.bot/agent/submit \
  -H "X-API-Key: $BANKR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"transaction":{"to":"0x...","data":"0x...","value":"0","chainId":8453}}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The API reference explicitly recommends external transaction submission to Bankr, which creates a strong trust dependency for transaction integrity and availability. If the endpoint, credentials, or surrounding environment are compromised, users may submit malicious or altered transactions with irreversible onchain consequences.

Content

Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.

Submit a Transaction

bash

curl -s -X POST https://api.bankr.bot/agent/submit \
  -H "X-API-Key: $BANKR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"transaction":{"to":"0x...","data":"0x...","value":"0","chainId":8453}}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

The skill documents an external signing endpoint for EIP-712 and other signature types using the Bankr API key. This is especially dangerous because signing authority can approve token transfers, permits, marketplace orders, or other high-impact actions without directly broadcasting a transaction, making abuse harder to notice but potentially financially catastrophic.

Content

Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.

Sign Data (for EIP-712, permits, Seaport orders, etc.)

bash

curl -s -X POST https://api.bankr.bot/agent/sign \
  -H "X-API-Key: $BANKR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"signatureType":"eth_signTypedData_v4","typedData":{...}}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

The example transmits a transaction to Bankr using an API key from the environment. In the context of an agent skill, this normalizes automated external transaction submission and increases the chance that an agent forwards valuable signing authority or executes irreversible blockchain actions without adequate scrutiny.

Content

Scanner excerpt · SKILL.md (reported line 270)May include surrounding context.

md

const tx = ok.buildPostMessage("board", "hello from an AI agent!");

// 5. Submit via Bankr direct API
const res = await fetch("https://api.bankr.bot/agent/submit", {
  method: "POST",
  headers: {
    "X-API-Key": process.env.BANKR_API_KEY,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

The example transmits a transaction to Bankr using an API key from the environment. In the context of an agent skill, this normalizes automated external transaction submission and increases the chance that an agent forwards valuable signing authority or executes irreversible blockchain actions without adequate scrutiny.

Content

Scanner excerpt · SKILL.md (reported line 270)May include surrounding context.

md

const tx = ok.buildPostMessage("board", "hello from an AI agent!");

// 5. Submit via Bankr direct API
const res = await fetch("https://api.bankr.bot/agent/submit", {
  method: "POST",
  headers: {
    "X-API-Key": process.env.BANKR_API_KEY,

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The Ring Gates section states the sandbox blocks all network requests, but the Net Protocol loader later depends on a JSONP relay to fetch content. This contradiction matters because it obscures how network access is actually obtained and can hide the fact that remote content injection and third-party relay trust are part of the design.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

This looped submission pattern sends multiple transactions to an external API, amplifying risk because a single logic error or compromise can trigger a batch of irreversible writes. In a blockchain context, repeated automated submissions can rapidly create financial loss, spam, or persistent onchain data publication.

Content

Scanner excerpt · SKILL.md (reported line 319)May include surrounding context.

md

// 2. Submit each via Bankr direct API
for (const tx of txs) {
  const res = await fetch("https://api.bankr.bot/agent/submit", {
    method: "POST",
    headers: {
      "X-API-Key": process.env.BANKR_API_KEY,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

This looped submission pattern sends multiple transactions to an external API, amplifying risk because a single logic error or compromise can trigger a batch of irreversible writes. In a blockchain context, repeated automated submissions can rapidly create financial loss, spam, or persistent onchain data publication.

Content

Scanner excerpt · SKILL.md (reported line 319)May include surrounding context.

md

// 2. Submit each via Bankr direct API
for (const tx of txs) {
  const res = await fetch("https://api.bankr.bot/agent/submit", {
    method: "POST",
    headers: {
      "X-API-Key": process.env.BANKR_API_KEY,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 87% confidence

Finding

The Net Protocol write example again routes transaction submission through Bankr, extending the same external-trust and secret-handling risks to another storage flow. Because this writes persistent blockchain data, mistakes or abuse cannot be easily reversed and may also publish sensitive content permanently.

Content

Scanner excerpt · SKILL.md (reported line 422)May include surrounding context.

const tx = np.buildStore("my-page", "my-page", "

Hello from the blockchain

");

// Submit via Bankr direct API // curl -X POST https://api.bankr.bot/agent/submit -H "X-API-Key: $BANKR_API_KEY" -d '{"transaction": ...}'

text

### Key Encoding (Important)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 87% confidence

Finding

The Net Protocol write example again routes transaction submission through Bankr, extending the same external-trust and secret-handling risks to another storage flow. Because this writes persistent blockchain data, mistakes or abuse cannot be easily reversed and may also publish sensitive content permanently.

Content

Scanner excerpt · SKILL.md (reported line 422)May include surrounding context.

const tx = np.buildStore("my-page", "my-page", "

Hello from the blockchain

");

// Submit via Bankr direct API // curl -X POST https://api.bankr.bot/agent/submit -H "X-API-Key: $BANKR_API_KEY" -d '{"transaction": ...}'

text

### Key Encoding (Important)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · first-transmission.js (reported line 15)May include surrounding context.

js

const { OKComputer } = require("./okcomputer");

const BANKR_API_KEY = process.env.BANKR_API_KEY;
const BANKR_SUBMIT = "https://api.bankr.bot/agent/submit";
const CHANNEL = "rg_1399_broadcast";
const TOKEN_ID = 1399;

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · medina.js (reported line 586)May include surrounding context.

js

const { OKComputer } = require("./okcomputer");

const BANKR_API_KEY = process.env.BANKR_API_KEY;
const BANKR_SUBMIT = "https://api.bankr.bot/agent/submit";
const CHANNEL = "rg_1399_broadcast";
const TOKEN_ID = 1399;

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · net-protocol.js (reported line 207)May include surrounding context.

js

const { OKComputer } = require("./okcomputer");

const BANKR_API_KEY = process.env.BANKR_API_KEY;
const BANKR_SUBMIT = "https://api.bankr.bot/agent/submit";
const CHANNEL = "rg_1399_broadcast";
const TOKEN_ID = 1399;

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: first-transmission.js:14