Security audit

Discover Artblocks Projects

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly an Art Blocks discovery helper, but it also points agents toward broader GraphQL and purchase-related tools outside its stated tool set.

Review this before installing. It is not destructive and contains no executable code, but users should be comfortable with agents querying broader Art Blocks data, aggregating holdings across linked wallets for usernames, and potentially following purchase-related tool references only with explicit user direction.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.
md
### Filters | Param | Type | Notes | | ------------------ | ------- | ----------------------------------------------------------------------------------------------------------------- | | `search` | string | Searches project name and artist name (case-insensitive partial match) | | `artistName` | string | Filter by artist name (case-insensitive partial match) |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.
md
| `search` | string | Searches project name and artist name (case-insensitive partial match) | | `artistName` | string | Filter by artist name (case-insensitive partial match) | | `chainId` | number | `1` (Ethereum), `42161` (Arbitrum), `8453` (Base) | | `verticalName` | string | See verticals below | | `mintable` | boolean | `true` = actively mintable projects only | | `tag` | string | Filter by tag (e.g. `"ab500"`, `"animated"`, `"curated series 1"`). Use `list_tags` to see all available tags. | | `minFloorPrice` | number | Minimum floor price in ETH |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.
md
| `search` | string | Searches project name and artist name (case-insensitive partial match) | | `artistName` | string | Filter by artist name (case-insensitive partial match) | | `chainId` | number | `1` (Ethereum), `42161` (Arbitrum), `8453` (Base) | | `verticalName` | string | See verticals below | | `mintable` | boolean | `true` = actively mintable projects only | | `tag` | string | Filter by tag (e.g. `"ab500"`, `"animated"`, `"curated series 1"`). Use `list_tags` to see all available tags. | | `minFloorPrice` | number | Minimum floor price in ETH |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.
md
| `verticalName` | string | See verticals below | | `mintable` | boolean | `true` = actively mintable projects only | | `tag` | string | Filter by tag (e.g. `"ab500"`, `"animated"`, `"curated series 1"`). Use `list_tags` to see all available tags. | | `minFloorPrice` | number | Minimum floor price in ETH | | `maxFloorPrice` | number | Maximum floor price in ETH — only returns projects with a listing at or below this price | | `isArtblocks` | boolean | `true` = Art Blocks flagship only, `false` = Engine only, omit for all | | `includeUnassigned`| boolean | Include test/dev projects (default false) |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.
md
| `includeUnassigned`| boolean | Include test/dev projects (default false) | | `sortBy` | string | `newest` (default), `oldest`, `name_asc`, `recently_updated`, `floor_asc`, `floor_desc`, `most_collected`, `edition_size_desc` | | `limit` | number | Default 25, max 200 | | `offset` | number | For pagination | ### Verticals

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation expands the skill's apparent capabilities beyond the declared manifest by referencing additional downstream tools and workflows not listed in the skill metadata. This can cause an agent to invoke undeclared tooling or rely on unsupported capabilities, weakening policy enforcement and creating an avenue for privilege or scope creep.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill states that wallet summary/token lookups aggregate holdings across all wallets linked to a profile, but it does not require an explicit user-facing warning or consent prompt about that broader visibility. In a portfolio-discovery context, this increases privacy risk by exposing a more complete cross-wallet picture than a user may expect from supplying a single identifier.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly recommends undeclared GraphQL escape-hatch tools, contradicting the documented tool set and encouraging bypass of the constrained, domain-specific interface. Escape hatches are dangerous because they often permit broader data access and less predictable query behavior than the reviewed skill surface.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.