Near Batch Sender

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:14 PM UTC
• Version: 1.0.0

Overview

This skill is purpose-aligned for NEAR batch transfers, but it needs review because it can move real assets in bulk and runs unvalidated shell commands from user-supplied JSON.

Install only if you are comfortable auditing the JSON input and running it in a controlled environment. Treat send and NFT commands as live irreversible asset transfers, verify every account, amount, contract, token ID, and network context, and prefer fixing the script to use argument-array process execution plus dry-run, confirmation, validation, and batch limits before using it with valuable assets.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/batch.js:16

Finding

OS Command Injection Through Unsanitized NEAR CLI Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/batch.js:16-17 and scripts/batch.js:39-40
Vulnerability Type: OS command injection
Risk Level: High

Vulnerable Code

js

const cmd = `near send ${senderAccount} ${recipient.account} ${recipient.amount}`;
await execAsync(cmd);

js

const cmd = `near call ${transfer.contract} nft_transfer '{"receiver_id":"${transfer.receiver}","token_id":"${transfer.token_id}"}' --accountId ${senderAccount}`;
await execAsync(cmd);

Technical Analysis

The Skill constructs shell command strings by directly interpolating values originating from command-line arguments and user-supplied JSON files. It then executes those strings with child_process.exec, which launches a shell.

The affected untrusted values include:

• senderAccount, supplied as a command-line argument.
• recipient.account and recipient.amount, read from the batch-send JSON file.
• transfer.contract, transfer.receiver, and transfer.token_id, read from the NFT-transfer JSON file.

These values are not validated, escaped, or passed as isolated process arguments. An attacker who can influence the CLI invocation or batch file can include shell metacharacters or command substitutions in a field. The shell can interpret that content as additional commands rather than as a literal NEAR CLI argument.

The quoted JSON argument in the NFT command does not provide adequate protection. Interpolated values can disrupt the surrounding shell quoting and introduce additional shell syntax.

Attack Path

1. An attacker creates or modifies a recipients or NFT transfers JSON file, or influences the senderAccount command-line argument.
2. The attacker places shell syntax in an affected field, such as an account or contract value containing a command separator followed by another command.
3. The victim invokes the Skill with send or nft.
4. The Skill reads the attacker-controlled val ...[truncated 846 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace child_process.exec with execFile or spawn, using a fixed executable name and a separate argument array. This prevents the shell from interpreting user-controlled metacharacters.

   js

   const { execFile } = require('child_process');
   const { promisify } = require('util');
   const execFileAsync = promisify(execFile);
   
   await execFileAsync('near', [
     'send',
     senderAccount,
     recipient.account,
     String(recipient.amount)
   ]);
   

2. Apply the same argument-array approach to NFT transfers. Serialize the contract-call payload with JSON.stringify instead of manually constructing JSON inside a shell command.

   js

   const payload = JSON.stringify({
     receiver_id: transfer.receiver,
     token_id: transfer.token_id
   });
   
   await execFileAsync('near', [
     'call',
     transfer.contract,
     'nft_transfer',
     payload,
     '--accountId',
     senderAccount
   ]);
   

3. Strictly validate all NEAR account and contract identifiers against the accepted NEAR account-ID syntax before execution.

4. Validate amounts as finite, positive decimal values within an explicitly defined range. Reject exponential notation, signs, whitespace, and unexpected characters if they are not required.

5. Validate the complete JSON schema before processing:

   • Require recipients or transfers to be an array.
   • Require every expected property to have the correct type.
   • Reject unknown, missing, empty, or excessively long values.
   • Limit the maximum number of batch operations.

6. Do not attempt to repair the existing design solely through shell escaping. Avoiding shell execution is more reliable and should be the primary control.

7. Run the Skill under a least-privileged account and protect local NEAR credentials with restrictive filesystem permissions. Consider requiring explicit confirmation before executing each b ...[truncated 27 chars]

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: near-batch-sender
description: Batch operations for NEAR tokens - send to multiple recipients, transfer NFTs, claim rewards with cost estimation.
---
# NEAR Batch Sender Skill

Batch operations for NEAR sends, NFT transfers, and claims with cost estimation.

## Description

This skill provides batch operations for sending NEAR tokens, transferring NFTs, and claiming rewards. Includes cost estimation before execution.

## Features

- Batch send NEAR to multiple addresses
- Batch transfer NFTs
- Batch claim operations
- Cost estimation before execution
- Progress tracking for batch operations

## Commands

### `n

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script executes real blockchain transfer commands in a loop immediately after parsing a JSON file, with no preview, confirmation prompt, dry-run mode, recipient validation, or transfer limit guardrails. In a batch-payment skill context, this is especially dangerous because a malformed or malicious input file can trigger multiple irreversible token transfers before the operator notices.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The NFT batch transfer path performs irreversible on-chain transfers directly from untrusted JSON input without a confirmation gate or strong validation of contract, receiver, and token identifiers. In this skill's wallet/asset-transfer context, that makes operator mistakes or tampered input especially costly, since multiple NFTs can be irreversibly transferred away in a single run.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README provides ready-to-run commands for batch sending NEAR and transferring NFTs, but it does not warn users that these actions move real assets, may be irreversible, and can cause large losses if recipient data is wrong or maliciously supplied. In a wallet/asset-management skill, omission of these warnings increases the chance of unsafe execution and social engineering, especially because batch operations amplify mistakes across many transfers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill enables irreversible token and NFT transfer operations but does not explicitly warn users that executing these commands moves on-chain assets and cannot be undone once submitted. In an agent context, batch execution increases the blast radius of mistakes, malformed input, or social engineering because multiple transfers can be signed and broadcast in one workflow.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The manifest description says the skill supports "claim rewards," implying operational claim functionality alongside batch sends and NFT transfers. In the code, the claim command is not implemented; it merely prints that integration is required and provides no claim behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.