OK Computers + Ring Gates + Net Protocol

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:40 AM UTC
• Version: 2.2.0

Overview

This looks like a legitimate OK Computers blockchain toolkit, but it needs review because it can submit irreversible onchain actions and includes a page loader that deliberately runs relay-delivered code outside the normal sandbox boundary.

Install only if you understand Base blockchain transaction risk and trust Bankr, the RPC providers, and okc-relay. Use a limited wallet/API key, inspect every transaction and signing request before submission, avoid the generic signing endpoint unless necessary, do not store private data onchain, and do not use the JSONP loader with untrusted content.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The skill gives conflicting safety guarantees: it first states pages must be fully self-contained with no external resources, then later recommends a JSONP relay to load external content and bypass the iframe sandbox. That inconsistency is dangerous because it normalizes a sandbox-escape pattern and could lead agents to fetch and render untrusted off-chain content despite earlier constraints.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The code explicitly uses a JSONP relay to bypass sandbox restrictions, then writes remotely retrieved HTML into the current document with document.open/document.write/document.close. This gives untrusted remote content full execution in the page origin, enabling arbitrary script execution, phishing UI replacement, data exfiltration, and complete takeover of the skill's DOM context.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill dynamically injects a script tag whose source is a remote relay endpoint and relies on a global JSONP callback, which is equivalent to executing arbitrary JavaScript from that endpoint. Because the returned blockchain content may then be treated as HTML and written into the page, the design creates a two-stage remote code/content execution path with no meaningful trust boundary.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README explicitly documents `medina.js deploy <channel> <id>` as an action that can assemble and deploy content to a page, but it does not warn that this changes onchain state and may overwrite visible content or incur irreversible transaction costs. In an agent-skill context, documentation that presents deployment as a routine command increases the chance an autonomous agent will execute it without human confirmation or scope checks.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This section promotes reading and writing through onchain contracts and states that writing requires a signed wallet transaction, but it lacks explicit warnings about financial cost, permanence, and the risk of unintended agent-initiated transactions. Because the skill is designed for AI agents and mentions transaction submission via Bankr, the missing caution materially raises the chance of unsafe automation rather than being merely informational.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The dashboard sends user-supplied fleet IDs and channel names to a hard-coded third-party Alchemy RPC endpoint during scans. Even though the calls are read-only, this exposes operator interests and queried identifiers to an external service without clear disclosure, which is a real privacy and data-governance issue in a monitoring tool.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill performs a remote relay request and dynamic script execution automatically on page load without any notice, consent, or explanation to the user. This increases risk because users cannot assess that third-party code and remotely sourced content are being loaded, reducing transparency and making abuse harder to detect.

External Transmission

Medium

• Category: Data Exfiltration

Content

const tx = ok.buildPostMessage("board", "hello from an AI agent!");

// 5. Submit via Bankr direct API
const res = await fetch("https://api.bankr.bot/agent/submit", {
  method: "POST",
  headers: {
    "X-API-Key": process.env.BANKR_API_KEY,

• Confidence: 83% confidence
• Finding: fetch("https://api.bankr.bot/agent/submit", { method: "POST"

External Transmission

Medium

• Category: Data Exfiltration

Content

// 2. Submit each via Bankr direct API
for (const tx of txs) {
  const res = await fetch("https://api.bankr.bot/agent/submit", {
    method: "POST",
    headers: {
      "X-API-Key": process.env.BANKR_API_KEY,

• Confidence: 84% confidence
• Finding: fetch("https://api.bankr.bot/agent/submit", { method: "POST"

External Transmission

Medium

• Category: Data Exfiltration

Content

const tx = ok.buildPostMessage("board", "hello from an AI agent!");

// 5. Submit via Bankr direct API
const res = await fetch("https://api.bankr.bot/agent/submit", {
  method: "POST",
  headers: {
    "X-API-Key": process.env.BANKR_API_KEY,

• Confidence: 83% confidence
• Finding: https://api.bankr.bot/

External Transmission

Medium

• Category: Data Exfiltration

Content

// 2. Submit each via Bankr direct API
for (const tx of txs) {
  const res = await fetch("https://api.bankr.bot/agent/submit", {
    method: "POST",
    headers: {
      "X-API-Key": process.env.BANKR_API_KEY,

• Confidence: 84% confidence
• Finding: https://api.bankr.bot/

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"test": "node test-ring-gate.js"
  },
  "dependencies": {
    "ethers": "^6.0.0"
  },
  "credentials": {
    "BANKR_API_KEY": {

• Confidence: 93% confidence
• Finding: "ethers": "^6.0.0"

VirusTotal

60/60 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: first-transmission.js:14