Near Batch Sender

• Outcome: Review
• Latest audit: May 28, 2026, 9:27 AM
• Version:
  1.0.0

Overview

The skill does what it says, but it can move NEAR/NFT assets in bulk and has weak safeguards around input files and command execution.

Install only if you fully trust the skill and will personally inspect every JSON input file before use. Prefer testnet or very small trials first, and avoid untrusted recipient or NFT files until the script uses argument-based process execution, validates inputs, and adds an explicit pre-transfer review/confirmation flow.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README provides direct commands for batch sending NEAR and transferring NFTs without clearly warning that these operations trigger real, irreversible on-chain asset transfers. In an agent skill context, this omission increases the chance of accidental execution by users who may interpret the examples as low-risk test commands, leading to unintended loss of funds or digital assets.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill facilitates irreversible blockchain actions involving token sends and NFT transfers, but it does not prominently warn users that mistaken recipient addresses, amounts, or contracts cannot typically be reversed. In a financial-transfer context, missing safety warnings increases the risk of accidental asset loss and social-engineering abuse, especially for batch operations where one mistake can affect many transfers at once.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script performs real NEAR token and NFT transfers in batch form immediately after loading a JSON file, with no confirmation prompt, dry-run preview, recipient summary, or transaction review step. In a batch-transfer skill, this is more dangerous because a malformed or malicious input file can trigger multiple irreversible blockchain operations and cause rapid asset loss before the user notices.

VirusTotal

64/64 vendors flagged this skill as clean.