Setup Stylus Contracts

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:47 AM UTC
• Version: 1.0.1

Overview

The skill matches its stated smart-contract setup purpose, but it tells users to run mutable installer and package-install commands that can execute local code without verification.

Review the setup commands before installing. Prefer official package-manager or Rust installation guidance, avoid piping network content directly into a shell, pin `cargo-stylus` to a reviewed version with locked dependencies when possible, and only deploy with a private key file whose permissions are restricted.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:16

Finding

Remote Installer Downloaded and Executed Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 16
Vulnerability Type: Remote payload retrieval and execution
Risk Level: Critical

Vulnerable Code

bash

curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh

Technical Analysis

This command downloads a mutable shell script from an external endpoint and passes it directly to sh. The TLS restrictions protect the network connection, but they do not independently verify the integrity or expected contents of the downloaded script. No version, cryptographic digest, or digital signature is pinned before execution.

Installing Rust is consistent with the Skill's declared setup functionality. However, immediate remote script execution is not the minimum-risk method of performing that installation. The effective code can change after the Skill has been reviewed, and it executes with all permissions held by the user invoking the command.

Attack Path

1. An attacker compromises or gains influence over the installer endpoint, its hosting infrastructure, DNS resolution, or a trusted certificate path.
2. The endpoint returns an attacker-controlled shell script.
3. curl retrieves the script without validating it against an expected digest or signature.
4. The shell pipe immediately passes the response to sh.
5. The malicious script executes locally with the invoking user's permissions.

Impact Assessment

Successful exploitation permits arbitrary command execution as the user following the instructions. The resulting access may include reading or modifying that user's files, source code, shell configuration, development credentials, and accessible signing keys. If the command is unnecessarily run with elevated privileges, the impact could expand to system-wide compromise. No privilege escalation, persistence, or credential exfiltration is directly present in the audited file itself.

Remediation

View remediation

Remediation Suggestions

• Do not pipe content obtained from the network directly into a shell.
• Prefer an operating-system package manager or an already installed Rust toolchain where practical.
• If the official installer must be used, download it to a local file first.
• Verify the downloaded artifact using an official digital signature or a pinned SHA-256 digest obtained through a separately trusted channel.
• Pin an installer version or reviewed artifact so its contents cannot silently change after audit.
• Allow the user to inspect the downloaded script before explicitly executing it.
• Document that installation should be performed as an unprivileged user and must not be prefixed with sudo.

A safer workflow should follow this pattern:

bash

curl --proto '=https' --tlsv1.2 -fLo rustup-init.sh https://sh.rustup.rs
sha256sum --check rustup-init.sh.sha256
sh rustup-init.sh

The checksum file and expected digest must come from an authenticated, trusted source and should be pinned to the reviewed installer release.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:23

Finding

Unpinned Cargo Package Is Installed with Forced Replacement

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 23
Vulnerability Type: Insecure third-party dependency installation
Risk Level: Medium

Vulnerable Code

bash

cargo install --force cargo-stylus

Technical Analysis

The command does not specify an exact package version or require locked dependency resolution. Consequently, users may install different package and transitive dependency versions depending on when they execute the instructions.

Cargo installation downloads and compiles third-party source code locally. Package build scripts and procedural macros can execute code during compilation. If a future package release or one of its resolved dependencies is compromised, following this instruction could execute malicious code on the user's machine.

The --force option also replaces an existing installation even when replacement is unnecessary. This exceeds the minimum changes required for initial setup and can overwrite a previously reviewed or known-good local version.

Attack Path

1. The cargo-stylus package or a transitive dependency publishes a compromised version, or the associated distribution account is compromised.
2. A user follows the unpinned installation instruction.
3. Cargo resolves the current available package and dependency versions rather than a previously reviewed set.
4. Cargo downloads and compiles the compromised source.
5. Malicious build-time code executes with the invoking user's permissions.
6. The --force option may replace an existing trusted installation with the compromised version.

Impact Assessment

Exploitation can provide arbitrary code execution under the invoking user's account during package compilation or installation. Accessible scope can include the user's project files, Cargo and shell configuration, development credentials, and other files available to that account. Forced replacement may also remove a known-good CLI version. The audited documentation does not itself ...[truncated 83 chars]

Remediation

View remediation

Remediation Suggestions

• Pin cargo-stylus to an exact, reviewed version.
• Use Cargo's locked dependency resolution when supported.
• Remove --force from the default installation command.
• Make upgrades an explicit, user-approved operation after reviewing release notes and provenance.
• Verify that the package is obtained from the expected registry and publisher.
• Consider documenting package integrity or provenance verification procedures.

Recommended form:

bash

cargo install cargo-stylus --version VERSION --locked

Replace VERSION with an exact reviewed release. If replacement of an existing installation is genuinely required, first verify the installed and intended versions, then request explicit user approval before using --force.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The | sh construct causes unreviewed remote content to be executed immediately, which is a classic dangerous chaining pattern. In a setup skill aimed at developers, this increases the likelihood that users will run the command verbatim, making any compromise of the fetched script directly impactful on the local machine.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

Install the Rust toolchain and WASM target:

bash

curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
rustup target add wasm32-unknown-unknown

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

cargo stylus deploy --endpoint="<RPC_URL>" --private-key-path="<KEY_FILE>"

text

> **Private key security:** Never use `--private-key` with a raw key on the command line — it will be visible in shell history and process lists. Always use `--private-key-path` with a file that has restrictive permissions (`chmod 600`), or use a hardware wallet / keystore.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The skill instructs users to fetch and immediately execute a remote script via curl ... | sh, which bypasses inspection and creates a supply-chain execution risk if the remote endpoint, transport, or DNS resolution is compromised. Although rustup.rs is a legitimate installer, piping network content directly into a shell is an unsafe pattern in a developer-facing skill.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

Install the Rust toolchain and WASM target:

bash

curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
rustup target add wasm32-unknown-unknown