T08 · Insecure Dependencies
Warning
- Location
package.json:12- Finding
Non-Reproducible Installation of Security-Sensitive Third-Party Dependencies
- Content
View full analysis
- Remediation
View remediation
Security audit
Linkdrop Agent CLI
Security checks for vulnerabilities and agentic risk
Overview
This skill appears purpose-built for Linkdrop transfers, but it handles wallet private keys and irreversible on-chain value transfers with insufficient safety disclosure and non-reproducible npm installation.
Review this carefully before installing. Use a dedicated low-balance wallet, install dependencies before exposing secrets, prefer a reviewed lockfile or `npm ci`, and treat claim URLs, stdout logs, private keys, API keys, recipient addresses, and chain selection as sensitive financial controls.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `linkdrop-agent.js` is the strict JSON CLI entrypoint.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `agentdrop-core.js` contains the Linkdrop and chain logic used by the CLI.
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill declares access to sensitive environment variables, including a blockchain private key and API credentials, but does not define an explicit tool scope such as permissions or allowed-tools. This increases the chance that an agent runtime may expose secrets more broadly than intended or invoke the skill without clear least-privilege boundaries, which is especially risky in a wallet-managing skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The send operation creates a funded claim link that can control real on-chain assets, yet the skill documentation does not clearly warn that anyone who obtains the link may be able to redeem the funds. Because claim-link leakage through logs, chat transcripts, stdout capture, or copy/paste mistakes can lead to irreversible asset loss, the omission materially increases user risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The claim operation redeems value on-chain to a destination address, but the documentation omits a clear warning that using the wrong URL, wrong recipient, or wrong chain can permanently send assets to an unintended destination. In the context of blockchain transfers, these mistakes are typically irreversible and can directly cause financial loss.
- Content
Static analysis
No suspicious patterns detected.