T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:49- Finding
Wallet-Signed Payments Lack Approval, Validation, and Spending Limits
- Content
View full analysis
- Remediation
View remediation
Security audit
Realtime NBA Sportsdata and analytics for Prediction Markets
Security checks for vulnerabilities and agentic risk
Overview
This skill’s paid NBA data purpose is clear, but it should be reviewed because it can direct an agent to sign repeated wallet payments without built-in approval, cost limits, or payment validation.
Install only if you are comfortable with an agent making paid x402 NBA data requests. Require wallet confirmation before each request or batch, verify the network, recipient, token, amount, and number of calls, set a strict spending cap, prefer testnet or a low-balance wallet, and treat returned API text as untrusted data during synthesis.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T01 · Skill Instruction Hijacking
Warning
- Location
prompts/analyze-game.md:5- Finding
Untrusted API Responses Are Inserted Directly into an LLM Instruction Prompt
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly directs the agent to make paid x402 requests and sign them with the user's wallet on Base Sepolia or Base mainnet, but it does not require explicit user consent, display cost information, or impose spending limits before payment. That creates a real risk of unauthorized or surprising charges, especially because the workflow encourages multiple paid calls for a single analysis request.
- Content