Qelt Contracts

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:21 AM UTC
• Version: 0.1.0

Overview

This skill mostly does what it says, but it also recommends unpinned npm/global tooling that would run mutable third-party code on the user's machine.

Use the direct curl/API workflow when possible. Before using the optional Hardhat plugin or CLI, pin exact package versions, avoid global installs, review npm package provenance and lifecycle scripts, and remember that any submitted contract source will become public if verification succeeds.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:158

Finding

Unpinned npm Dependencies May Execute Mutable Third-Party Code

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 158–164
Vulnerability Type: Unpinned third-party dependencies and unsafe package execution
Risk Level: Medium

Vulnerable Code

markdown

**Hardhat Plugin:** `npm install --save-dev @qelt/hardhat-verify@latest`

```bash
npx hardhat qelt:verify --network qelt 0xCONTRACT_ADDRESS

CLI Tool: npm install -g qelt-verify → qelt-verify verify 0x... ./Contract.sol --compiler-version 0.8.20 --optimize

text

The same unsafe installation pattern is repeated in `references/verification-guide.md`, lines 158–170:

```markdown
Latest version: `@qelt/hardhat-verify@1.0.12`

```bash
npm install --save-dev @qelt/hardhat-verify@latest
npx hardhat qelt:verify --network qelt 0xCONTRACT_ADDRESS

Features: auto-detects viaIR, EVM version, routes single vs multi-file automatically.

CLI Tool

Latest version: qelt-verify@1.1.0

bash

npm install -g qelt-verify
qelt-verify init
qelt-verify verify 0xCONTRACT ./Contract.sol --compiler-version 0.8.20 --optimize --watch

text

### Technical Analysis

The documented workflow installs `@qelt/hardhat-verify` through the mutable `latest` tag and installs `qelt-verify` without specifying a version. It then executes the installed tools. Consequently, the code reviewed today is not necessarily the code users will install later.

npm packages can execute lifecycle scripts during installation. The packages also obtain direct code execution when users invoke the Hardhat task or CLI. If a package, maintainer account, release process, or transitive dependency is compromised, a malicious future release could execute arbitrary code with the permissions of the user running npm. Global installation of `qelt-verify` increases system-wide exposure and makes dependency provenance harder to reproduce.

The guide identifies current package versions, but the installation commands do not pin those versions and provide no integrity or provenance verification.

### At
...[truncated 1549 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace mutable or implicit versions with reviewed exact versions:

   bash

   npm install --save-dev --save-exact @qelt/hardhat-verify@1.0.12
   npm install --save-dev --save-exact qelt-verify@1.1.0
   

2. Avoid global package installation. Prefer a pinned local development dependency invoked through a package script or an explicitly pinned command.

3. Commit a lockfile and use reproducible installation in automated environments:

   bash

   npm ci
   

4. Review package provenance, publisher identity, lifecycle scripts, and transitive dependencies before recommending or upgrading a version.

5. Validate package integrity through the lockfile and npm registry integrity metadata. Where supported, require package provenance attestations.

6. Introduce a controlled dependency-update process in which new releases are reviewed and tested before the documentation's pinned version is changed.

7. Retain the direct HTTPS REST API workflow as the preferred option when installation of third-party executable tooling is unnecessary.

8. Update both SKILL.md and references/verification-guide.md together so that their commands consistently use the same reviewed versions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

1. Check if Already Verified (Do This First)

bash

curl -fsSL "https://mnindexer.qelt.ai/api/v2/contracts/0xCONTRACT/verification"

If "verified": true → return existing source/ABI to user, no submission needed.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.