Ae1
High
- Category
- analysis-evasion
- Content
scripts/query.sh search_resources '{"query":"x402","limit":3}'- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Security audit
sato-hub
Security checks for vulnerabilities and agentic risk
Overview
The skill is mostly a disclosed Sato Hub query integration, but its read-only framing is contradicted by write-capable remote tools and finance-adjacent routing outputs that users should review carefully.
Install only if you are comfortable giving the Sato Hub MCP endpoint access to the queries and routing inputs you provide. Treat swap calldata, launch configs, x402 routing, scaffolded repos, and build plans as advisory only; independently review fees, recipients, source URLs, and generated files before signing, deploying, paying, or submitting anything. Avoid using the write tools unless you intentionally want to create a watch subscription, submit a project, or register an agent passport with Sato Hub.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)
Ae1
High
- Category
- analysis-evasion
- Content
scripts/query.sh search_resources '{"query":"x402","limit":3}'- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
scripts/query.sh search_resources '{"query":"x402","limit":3}'- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
scripts/query.sh search_resources '{"query":"x402","limit":3}'- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
scripts/query.sh search_resources '{"query":"x402","limit":3}'- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
scripts/query.sh search_resources '{"query":"x402","limit":3}'- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Description-Behavior Mismatch
High
- Confidence
- 99% confidence
- Finding
- The skill metadata says the MCP server is "read-only," but the documented toolset explicitly includes three WRITE operations: `onchain_agent_watch`, `onchain_agent_submit_project`, and `onchain_agent_register_agent`. This mismatch can cause an agent or user to grant trust or broader execution than intended, leading to unintended external side effects such as subscriptions, submissions, or identity registration against a remote service.
Lp3
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
- The skill advertises a bundled shell script (`scripts/query.sh`) and explicitly instructs users to run it, but the manifest does not declare any tool scope such as `permissions` or `allowed-tools`. That creates a capability/transparency gap: consumers may not realize the skill expects shell execution and outbound network access, which weakens sandboxing and review controls even if the documented use is read-only.
External Transmission
Medium
- Category
- Data Exfiltration
- Content
move; re-run before quoting. Every one of these is read-only: **nothing signs, holds a key, deploys, relays or moves funds.** Each example shows equivalent calls — raw curl (JSON-RPC over the MCP endpoint), the bundled script, and the plain REST route. ## 7. Preflight a repo before you install it
- Confidence
- 60% confidence
- Finding
- Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Description-Behavior Mismatch
Medium
- Confidence
- 92% confidence
- Finding
- The documented REST fallback exposes endpoints for swap routing, agent routing, launch routing, and x402 routing that materially exceed a narrow read-only index-query role. Even if the service itself claims to be read-only and does not sign or move funds, returning calldata, venue selection, deployer configs, or payment-routing targets can steer downstream agents into sensitive actions with insufficient scope separation, creating a confused-deputy risk.
Context-Inappropriate Capability
Medium
- Confidence
- 90% confidence
- Finding
- A skill presented as an index/query tool also advertises transaction-routing, launch-preparation, and x402 destination-selection capabilities, which are operationally adjacent to financial or deployment actions. This mismatch increases the chance that an agent or user will trust the skill in low-risk contexts while unknowingly using outputs that influence swaps, payments, or token launches, raising the chance of harmful automation or misuse.
Description-Behavior Mismatch
Medium
- Confidence
- 84% confidence
- Finding
- The manifest frames the skill as a read-only query interface for looking up tooling, standards, project reality, and citable figures. The documented preflight, routing, and build-plan tools instead provide decision support and next-action recommendations, which is broader than straightforward querying of an index.
Description-Behavior Mismatch
Medium
- Confidence
- 91% confidence
- Finding
- The skill description frames the capability as query-oriented and read-only, but `onchain_agent_scaffold_plan` produces a starter repository zip and related artifacts. Even if generation is deterministic and sourced, artifact creation expands the operational scope from passive lookup to producing executable/project material, which can mislead downstream agents about the level of trust and review required.
External Transmission
Medium
- Category
- Data Exfiltration
- Content
} mcp_post() { /usr/bin/env curl -sS --max-time "$TIMEOUT" -X POST "$ENDPOINT" \ -H 'Content-Type: application/json' \ -H 'Accept: application/json, text/event-stream' \ --data "$1"- Confidence
- 70% confidence
- Finding
- Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Static analysis
No suspicious patterns detected.