T08 · Insecure Dependencies
Error
- Location
scripts/package.json:11- Finding
Mutable Third-Party Dependencies Handle the Wallet Private Key
- Content
View full analysis
- Remediation
View remediation
Security audit
permissionless prediction markets
Security checks for vulnerabilities and agentic risk
Overview
The skill is coherent for managing prediction markets, but it asks agents to run wallet-backed mainnet transaction scripts with unsafe financial defaults and mutable dependencies.
Review this carefully before installing. Use only a dedicated, low-balance wallet, avoid primary wallets, pin and audit dependencies with a lockfile, prefer exact or capped token approvals, revoke allowances after use, and set explicit nonzero slippage protection before trading. Treat the examples as live Base mainnet transactions that can spend funds and incur gas.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/settle.ts:92- Finding
Read-Only Settlement Status Requires Unnecessary Private-Key Access
- Content
View full analysis
= endTime; console.log(`\nCan Settle: ${canSettle}`); if (!canSettle) { const remaining = endTime - now; const hours = Math.floor(remaining / 3600); const mins = Math.floor((remaining % 3600) / 60); console.log(`Time Left: ${hours}h ${mins}m`); } console.log("\n--- JSON OUTPUT ---"); console.log(JSON.stringify({ settled: false, canSettle, endTime }, null, 2)); process.exit(0); } ``` A corresponding issue exists in `scripts/trade.ts:122-145`, where `--info` also requires a private key despite only retrieving market information and prices. ### Technical Analysis Blockchain state queries do not require transaction signing. A public RPC provider is sufficient to retrieve market information, prices, resolution status, and token identifiers. Requiring `PRIVATE_KEY` before identifying whether the operation is read-only unnecessarily exposes the credential to the Node.js process and all loaded dependencies. This behavior exceeds the minimum privileges necessary for `--status` and `--info`. It increases the consequences of a compromised dependency, runtime instrumentation, debugging tool, crash reporter, or accidental environmen ...[truncated 917 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/trade.ts:93- Finding
Trades Default to No Slippage Protection
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:116- Finding
Unlimited ERC20 Allowances Exceed the Required Spending Scope
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (44)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
The declared description claims broad lifecycle support for prediction markets: create, trade, and settle on Base with any ERC20 collateral. The supplied code only implements one narrow function: trading on an existing market (buy/sell YES/NO) plus fetching market info. It requires a wallet private key, checks market status, and submits buy/sell transactions through PNPClient. There is no code for creating markets, resolving/settling them, managing contests, crowdsourcing workflows, or explicit support for arbitrary ERC20 collateral selection. Because the primary advertised scope is materially broader than the code’s actual behavior, this is a description-behavior mismatch.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 87% confidence
- Finding
The skill instructs users to supply sensitive environment variables such as PRIVATE_KEY and RPC_URL, but it does not declare any explicit tool scope or permissions boundary. In an agent setting, missing scope declarations can lead to broader-than-expected access to secrets or runtime capabilities, especially when the skill is used alongside code execution or shell tooling.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 84% confidence
- Finding
Using 'npx ts-node' without pinning an exact package version introduces supply-chain risk because the resolved package version can change over time or be influenced by the environment. In a blockchain skill that handles private keys and transactions, unexpected dependency changes could lead to malicious code execution or altered transaction behavior.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 84% confidence
- Finding
Using 'npx ts-node' without pinning an exact package version introduces supply-chain risk because the resolved package version can change over time or be influenced by the environment. In a blockchain skill that handles private keys and transactions, unexpected dependency changes could lead to malicious code execution or altered transaction behavior.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 84% confidence
- Finding
Using 'npx ts-node' without pinning an exact package version introduces supply-chain risk because the resolved package version can change over time or be influenced by the environment. In a blockchain skill that handles private keys and transactions, unexpected dependency changes could lead to malicious code execution or altered transaction behavior.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 84% confidence
- Finding
Using 'npx ts-node' without pinning an exact package version introduces supply-chain risk because the resolved package version can change over time or be influenced by the environment. In a blockchain skill that handles private keys and transactions, unexpected dependency changes could lead to malicious code execution or altered transaction behavior.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 84% confidence
- Finding
Using 'npx ts-node' without pinning an exact package version introduces supply-chain risk because the resolved package version can change over time or be influenced by the environment. In a blockchain skill that handles private keys and transactions, unexpected dependency changes could lead to malicious code execution or altered transaction behavior.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 84% confidence
- Finding
Using 'npx ts-node' without pinning an exact package version introduces supply-chain risk because the resolved package version can change over time or be influenced by the environment. In a blockchain skill that handles private keys and transactions, unexpected dependency changes could lead to malicious code execution or altered transaction behavior.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 84% confidence
- Finding
Using 'npx ts-node' without pinning an exact package version introduces supply-chain risk because the resolved package version can change over time or be influenced by the environment. In a blockchain skill that handles private keys and transactions, unexpected dependency changes could lead to malicious code execution or altered transaction behavior.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 84% confidence
- Finding
Using 'npx ts-node' without pinning an exact package version introduces supply-chain risk because the resolved package version can change over time or be influenced by the environment. In a blockchain skill that handles private keys and transactions, unexpected dependency changes could lead to malicious code execution or altered transaction behavior.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 84% confidence
- Finding
Using 'npx ts-node' without pinning an exact package version introduces supply-chain risk because the resolved package version can change over time or be influenced by the environment. In a blockchain skill that handles private keys and transactions, unexpected dependency changes could lead to malicious code execution or altered transaction behavior.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 84% confidence
- Finding
Using 'npx ts-node' without pinning an exact package version introduces supply-chain risk because the resolved package version can change over time or be influenced by the environment. In a blockchain skill that handles private keys and transactions, unexpected dependency changes could lead to malicious code execution or altered transaction behavior.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 84% confidence
- Finding
Using 'npx ts-node' without pinning an exact package version introduces supply-chain risk because the resolved package version can change over time or be influenced by the environment. In a blockchain skill that handles private keys and transactions, unexpected dependency changes could lead to malicious code execution or altered transaction behavior.
- Content
Unrestricted Tool Access
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
- Content
md ## Scripts Run any script with `--help` first to see all options. ### Create Market
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill explicitly normalizes infinite ERC20 approvals and frames them mainly as standard UX optimization without an equally explicit warning that this grants the spender ongoing access to the user's full token balance. In a DeFi context, if the spender contract, SDK path, or private key flow is compromised, users can lose substantially more than the intended trade amount.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 78% confidence
- Finding
The documentation describes a workflow where approvals are automatically sent and later transactions execute directly with no further approval step. In an agentic or automated setting, this reduces user friction but also reduces transaction-by-transaction oversight, making unintended or abusive token spending easier once approval has been granted.
- Content
md 1. **First interaction requires approval**: When you create a market or trade for the first time with a token, an approval transaction is sent 2. **Infinite approvals**: The SDK uses `type(uint256).max` approvals (standard EVM pattern) so you only approve once per token 3. **Subsequent interactions**: No approval needed—transactions execute directly ### Timing Considerations
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The API reference instructs users to pass a raw wallet private key into the client configuration without any warning about credential sensitivity, secure storage, or the risks of embedding secrets in code. In an agent/tooling context, this increases the chance that operators hardcode keys, expose them in logs, prompts, repos, or runtime configs, leading to wallet compromise and unauthorized on-chain transactions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The transactional examples show market creation and trading calls that can submit real on-chain transactions affecting funds, but they do not clearly warn that these operations spend assets, incur gas, and may execute against mainnet by default. In an agent skill for prediction-market infrastructure, this is especially risky because an automated consumer may treat examples as safe read-only usage and trigger unintended financial actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The examples instantiate a wallet-backed client from a private key and perform live market creation, trading, settlement, and redemption against Base mainnet. In documentation for an agent skill, users may copy-paste these examples verbatim, causing real on-chain transactions and potential loss of funds without any explicit warning, dry-run guidance, or testnet-only default.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The shebang
#!/usr/bin/env npx ts-nodecauses execution to depend on whatevernpxresolves at runtime rather than a pinned, trusted local binary. In a wallet-operating script that consumesPRIVATE_KEYand submits on-chain transactions, a malicious or substitutedts-nodepackage could execute arbitrary code and exfiltrate secrets or alter transaction behavior.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 87% confidence
- Finding
The help text instructs users to run the script via
npx ts-node, which encourages fetching or resolving an unpinned executable at runtime. Because this script requires a private key and interacts with markets on Base, compromise of that execution path could lead to key theft or unauthorized transactions.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 87% confidence
- Finding
This example command again normalizes executing the script through unpinned
npx ts-node, creating a supply-chain risk in the user workflow. In context, the risk is elevated because the script processes sensitive wallet material from environment variables and can move funds on-chain.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 87% confidence
- Finding
The custom-token example also tells users to execute the script with unpinned
npx ts-node, preserving the same dependency-resolution risk. If an attacker controls package resolution or a developer runs this in an untrusted environment, arbitrary code could run before market creation and access the configured private key.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Static analysis
No suspicious patterns detected.