Security audit

8004

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent blockchain agent-trust guide, but it gives examples for persistent publication, payments, on-chain writes, unpinned installs, and agent-supplied URLs without enough safety guidance.

Review this skill carefully before installing or following its snippets. Use pinned SDK versions in isolated environments, prefer testnet examples, require explicit wallet/payment confirmation, avoid publishing secrets or internal endpoints to IPFS, and validate or proxy all agent-supplied URLs before any server-side interaction.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:48
Finding: Unpinned Third-Party SDK Dependencies
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:200
Finding: Unvalidated Agent-Controlled URLs Permit Server-Side Request Forgery
Content: View full analysis
r.json()); const endpoint = agentData.endpoints.find(e => e.type === 'a2a'); // 4. Interact with verified agent const result = await interactWithAgent(endpoint.url); ``` ### Technical Analysis The example retrieves `identity.agentURI` and then uses metadata from that response to select and contact `endpoint.url`. Both values may ultimately be controlled by the registered agent. The prior identity and reputation checks establish on-chain registration and a reputation score, but they do not establish that either URL is safe for the caller's network environment. The example does not apply: - Allowed protocol or hostname validation. - DNS resolution and destination IP validation. - Loopback, private, link-local, multicast, or cloud metadata address blocking. - Redirect validation at every redirect hop. - Request timeouts or response-size limits. - A strict metadata schema. - Checks that an A2A endpoint exists and is structurally valid. - Cryptographic binding between immutable metadata and the registered identity. If this workflow runs on a server, agent platform, CI worker, or cloud instance, an attacker could provide a URL targeting services that are accessible to that runtime but inaccessible from the public internet. The initial metadata response can also direct the second request to a separate attacker-selected destination. ### Attack Path 1. An attacker registers an agent identity or gains control of metadata referenced by an existing registered identity. 2. The attacker obtains sufficient apparent reputation to pass the configured threshold, potentially through legitimate history or manipulated feedback. 3. A victim invokes `verifyAndInteract` ...[truncated 1573 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs users to upload agent metadata and public endpoints to IPFS without explaining that IPFS content is effectively public and persistent, which can expose sensitive operational details, wallet addresses, infrastructure URLs, or organizational information. In a trust/identity protocol for agents, this context makes the omission more dangerous because the published data is specifically intended for discovery across organizational boundaries.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill includes examples for agent registration and paid x402 requests that can trigger blockchain transactions or payment flows, but it does not warn users that these actions may spend real funds, require wallet authorization, or be irreversible once submitted. In an agent-skill context, users may copy or automate these snippets directly, increasing the chance of unintended financial loss or unauthorized spending behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.