Solidity Audit Precheck

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:33 AM UTC
• Version: 1.0.1

Overview

The skill is a coherent Solidity audit checklist, but its setup asks users to run unverified remote and unpinned package installers with broad local execution authority.

Review the setup commands before installing. Prefer pinned versions, isolated environments or containers, local/project installs, and checksum or signature verification for Foundry and other tools. Do not run these commands with sudo or from an account that has sensitive wallet, deployment, or production credentials available.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:53
• Finding: Unverified Remote Script Is Piped Directly into Bash<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 53 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash # Foundry (forge, cast, anvil) — for testing and gas snapshots curl -L https://foundry.paradigm.xyz | bash && foundryup ``` ### Technical Analysis The installation command downloads mutable content from an external URL and immediately executes it with Bash. It does not pin an installer version, validate a cryptographic checksum or publisher signature, or provide an opportunity to inspect the downloaded script before execution. Although Foundry is relevant to the declared Solidity audit workflow, executing an unverified network response is not necessary to provide that functionality and violates least-privilege and secure supply-chain principles. The effective payload can change after the Skill has been reviewed. The subsequent `foundryup` command may also retrieve and install additional remote artifacts. The use of HTTPS protects the connection under normal circumstances but does not protect against compromise of the hosting service, publishing infrastructure, domain, certificate authority, or upstream release process. ### Attack Path 1. An attacker compromises the remote installer endpoint, its publishing infrastructure, or another trusted part of the delivery chain. 2. The user follows the documented setup instructions. 3. `curl -L` retrieves attacker-controlled shell instructions, including content reached through HTTP redirects. 4. The pipe sends the response directly to Bash without integrity or authenticity verification. 5. Bash executes the payload with all permissions available to the invoking user. 6. The payload can access the Solidity repository, user files, environment variables, credentials, wallet-related files, and available network resources. It could also install persistence or download additional components. ### Impact Assessment Successful exploitat ...[truncated 658 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not pipe a network response directly into a shell. 2. Pin Foundry to a specifically reviewed release rather than installing an implicitly current version. 3. Download the release artifact and its signature or checksum as separate files. 4. Verify the artifact using a trusted publisher signature or an independently obtained SHA-256 checksum before execution. 5. Inspect the installer or use a documented package-manager installation method with release provenance verification. 6. Run installation as an unprivileged user in an isolated development environment or container. 7. Document the expected domains, artifact names, version, checksum, and verification commands. A safer conceptual workflow is: ```bash curl --fail --show-error --location \ --output foundry-installer.sh \ "https://trusted.example/path/to/pinned/foundry-installer.sh" printf '%s %s\n' '<reviewed-sha256>' 'foundry-installer.sh' | sha256sum --check - less foundry-installer.sh bash foundry-installer.sh ``` The project should replace the placeholders with a publisher-documented, version-specific artifact and an independently trusted checksum or signature. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:46
• Finding: Security Tools Are Installed from Registries Without Version or Integrity Pinning<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 46–59 **Vulnerability Type**: Insecure dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash # Slither — most complete static analyzer pip install slither-analyzer # Mythril — symbolic execution / SMT-based analysis pip install mythril # Foundry (forge, cast, anvil) — for testing and gas snapshots curl -L https://foundry.paradigm.xyz | bash && foundryup # Solhint — linter for style and security rules npm install -g solhint # Aderyn — Rust-based Solidity AST analyzer (fast) cargo install aderyn ``` ### Technical Analysis The Python, npm, and Cargo commands install dependencies without exact version constraints or locked transitive dependency sets. Consequently, the installed code depends on whichever releases and dependency resolutions the registries serve at execution time. Package installation can invoke package-controlled build scripts, setup logic, or lifecycle hooks. If a package maintainer account, registry, release process, or transitive dependency is compromised, malicious code could execute during installation. The global npm installation also broadens the modification scope to the user's global npm environment and may require elevated permissions on some systems. The named tools are consistent with the Skill's declared Solidity-analysis functionality, and there is no evidence in the reviewed file that these packages are themselves malicious. The vulnerability is the absence of reproducible version and integrity controls, not the mere use of third-party tools. ### Attack Path 1. An attacker compromises a referenced package, one of its transitive dependencies, a maintainer account, or relevant registry infrastructure. 2. The attacker publishes a malicious version that satisfies the unbounded installation request. 3. A user executes one of the documented `pip`, `npm`, or `cargo` installation commands. 4. The package manager selects and downloads the c ...[truncated 988 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin each direct tool to an exact, reviewed version. 2. Lock transitive dependencies and require integrity hashes where the package ecosystem supports them. 3. Use isolated virtual environments, containers, or project-local installations rather than global installations. 4. Do not run package installation commands with `sudo` or an administrator account. 5. Verify package ownership, release provenance, signatures, and checksums before approving version updates. 6. Update dependencies through a controlled review process rather than automatically resolving the latest release. 7. Store the approved toolchain configuration in version control to make audit runs reproducible. Recommended controls include: - Python: use an isolated virtual environment and a hash-locked requirements file, then install with `pip install --require-hashes -r requirements.txt`. - npm: use a project-local exact dependency and commit a trusted lockfile; avoid `npm install -g`. - Cargo: specify an exact reviewed version with `cargo install --version <exact-version> --locked aderyn`. - Foundry: use a pinned release artifact with verified signature or checksum, as described in the remote-execution finding. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

External Script Fetching

High

• Category: Supply Chain

Content

pip install mythril

# Foundry (forge, cast, anvil) — for testing and gas snapshots
curl -L https://foundry.paradigm.xyz | bash && foundryup

# Solhint — linter for style and security rules
npm install -g solhint

• Confidence: 97% confidence
• Finding: The skill instructs users to execute a remote script directly via `curl ... | bash`, which bypasses integrity verification and gives the remote server immediate code execution on the analyst's machine. If the hosting endpoint, network path, or upstream distribution is compromised, users following the skill could install malicious software during a security workflow, making this especially risky because the audience is likely to run the command with developer privileges.

Static analysis

No suspicious patterns detected.