celo-composer

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:09 PM UTC
• Version: 1.0.2010

Overview

This is a coherent Celo project scaffolding guide, but it repeatedly tells users to execute an unpinned npm package and includes blockchain deployment steps without enough safety framing.

Review the npm package and prefer a pinned, vetted version before running the npx commands. Run scaffolding in a clean workspace without private keys or unnecessary credentials in the shell, and only add deployment keys after reviewing the generated project. Treat the Hardhat and Foundry deploy examples as transaction-broadcasting steps that may spend funds and should be tested on the intended network with low-privilege development keys.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:27

Finding

Execution of an Unpinned npm Package Through a Mutable Latest Tag

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:27, SKILL.md:33, SKILL.md:39-42, SKILL.md:47, SKILL.md:63, SKILL.md:69; references/templates.md:8, references/templates.md:38, references/templates.md:65, references/templates.md:91, references/templates.md:99, references/templates.md:107, references/templates.md:125-128, references/templates.md:134-137, references/templates.md:143-146
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code

The primary instructions execute the mutable latest release directly:

bash

npx @celo/celo-composer@latest create

bash

npx @celo/celo-composer@latest create my-celo-app

bash

npx @celo/celo-composer@latest create my-celo-app \
  --template basic \
  --wallet-provider rainbowkit \
  --contracts hardhat

bash

npx @celo/celo-composer@latest create my-celo-app --yes

bash

npx @celo/celo-composer@latest create -t minipay

bash

npx @celo/celo-composer@latest create -t farcaster-miniapp

The template reference repeats the same unsafe dependency-selection pattern:

bash

npx @celo/celo-composer@latest create my-app --template basic

bash

npx @celo/celo-composer@latest create my-app --template minipay

bash

npx @celo/celo-composer@latest create my-app --template farcaster-miniapp

bash

npx @celo/celo-composer@latest create my-app --template ai-chat

bash

npx @celo/celo-composer@latest create my-app --wallet-provider rainbowkit

bash

npx @celo/celo-composer@latest create my-app --wallet-provider thirdweb

bash

npx @celo/celo-composer@latest create my-app --wallet-provider none

bash

npx @celo/celo-composer@latest create my-app \
  --template minipay \
  --wallet-provider none \
  --contracts hardhat

bash

npx @celo/celo-composer@latest create
...[truncated 2736 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace every @latest reference with an explicitly reviewed package version, such as @celo/celo-composer@X.Y.Z.
2. Review the selected release, its transitive dependencies, package lifecycle scripts, and published provenance before recommending it.
3. Update pinned versions only through a deliberate review process rather than allowing distribution-tag changes to alter executed code automatically.
4. Where the workflow permits, install dependencies through a committed lockfile and use a reproducible installation command such as npm ci or the equivalent package-manager operation.
5. Verify registry integrity metadata and supported package provenance or signatures before execution.
6. Run scaffolding tools with the minimum required privileges in an isolated workspace. Do not invoke them as root or from a shell containing unnecessary credentials.
7. Keep wallet private keys and deployment credentials out of the environment while running third-party scaffolding tools. Populate contract environment files only after scaffolding is complete and the generated project has been reviewed.
8. Add documentation explaining the trust implications of executing npm packages and a process for validating future version upgrades.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (24)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs users to run npx @celo/celo-composer@latest create, which fetches and executes the latest published package version at runtime. This creates a supply-chain risk because a compromised maintainer account, malicious release, or dependency hijack could cause arbitrary code execution on the user's machine.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

This command again relies on npx @celo/celo-composer@latest, which executes unpinned remote code. Repetition in a quick-start path increases the chance users will copy-paste it without reviewing what version is being installed.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The non-interactive example still uses the latest package tag, so users may automate execution of whatever code is current on the registry at the moment they run it. In CI or scripted setup flows, this reduces reproducibility and magnifies the impact of a malicious or broken upstream release.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The --yes variant combines non-interactive execution with @latest, making it easier to execute newly published code without review or prompts. This increases exposure to silent supply-chain compromise or accidental breaking changes.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

This MiniPay example repeats the unpinned npx package execution pattern, preserving the same arbitrary code execution and reproducibility risks. The skill context is a setup guide, so users are especially likely to trust and run the command directly.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The Farcaster Miniapp example also uses an unpinned remote package invocation. Because the skill presents this as standard workflow, it normalizes executing unaudited latest-version code directly from the package registry.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill documents Hardhat and Foundry deployment commands that can sign and broadcast on-chain transactions, but it does not explicitly warn that these operations can change blockchain state and spend funds. In a copy-paste oriented setup guide, users may run them without understanding the financial and operational consequences, especially once private keys are configured in environment files.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The documentation instructs users to run npx @celo/celo-composer@latest, which fetches and executes the newest published package at runtime rather than a reviewed, immutable version. If the npm package is compromised, typosquatted, or a malicious update is published, users following the docs could execute attacker-controlled code on their machines.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This command uses npx with the @latest tag, causing users to execute whatever version is current on the registry at the time of use. That creates a supply-chain execution risk because documentation becomes an implicit trust channel for unreviewed future releases.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The MiniPay template advertises automatic wallet connection based on environment detection and shows code that calls connectWallet() on page load without any user prompt or warning. While not an immediate transaction-signing issue by itself, auto-connecting a wallet can surprise users, expose wallet addresses without clear consent, and normalize patterns that reduce user awareness around wallet interactions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

Referencing npx @celo/celo-composer@latest means the command is non-deterministic and can execute newly published code without prior review. In a developer setup context, that can lead to workstation compromise, credential theft, or malicious project scaffolding if the package supply chain is attacked.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The example tells users to execute a remote npm package selected by the mutable latest tag. Because npx runs package code, any malicious or compromised release could immediately affect the local environment or generated application.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This unpinned npx invocation creates a supply-chain risk by delegating trust to whichever version the npm registry resolves at runtime. Attackers who compromise the package publisher or dependency chain could distribute malicious scaffolding commands through the documentation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

Using @latest in a command that users are expected to copy-paste exposes them to arbitrary future package changes and possible malicious code execution. Since this is setup documentation, users are likely to trust and run it without additional scrutiny.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The command is vulnerable to npm supply-chain abuse because it relies on a floating package reference that is executed immediately. Documentation that normalizes npx ...@latest increases the chance that users run unreviewed code on developer machines.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This example executes a mutable npm artifact via npx, making the behavior dependent on the current registry state rather than the documentation author’s reviewed version. If the package or one of its installation-time behaviors becomes malicious, readers can be exposed immediately.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The use of @latest introduces non-reproducible and potentially unsafe execution of third-party code from npm. In a scaffolding tool context, the executed code may create files, install dependencies, or run scripts, amplifying the effect of a compromised release.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

Because npx runs package code directly, using the mutable latest tag creates a straightforward path for supply-chain compromise to reach users who follow the docs. This is especially relevant in developer tooling, where local credentials and source code may be accessible.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The command encourages execution of an unpinned npm package, which can silently change over time and be abused through compromised publishing or dependency tampering. The trust users place in official setup examples increases the practical risk of exploitation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This documentation snippet exposes users to supply-chain risk by instructing them to execute the newest registry version rather than a fixed one. An attacker controlling a future release could gain code execution during project creation or environment setup.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The final example repeats the same pattern of direct execution of a floating npm package version, which is a real supply-chain security weakness in documentation. Multiple occurrences increase exposure because readers may encounter and reuse any of these commands.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.