T09 · Insecure Skill Coding Practices
Error
- Location
check_job.js:3- Finding
Hardcoded Live Bearer Token Exposes External API Access
- Content
View full analysis
- Remediation
View remediation
Security audit
Near Multi Account Manager
Security checks for vulnerabilities and agentic risk
Overview
This NEAR wallet skill mostly matches its stated purpose, but it bundles unrelated authenticated marketplace scripts and has weak safeguards around private keys and real mainnet transfers.
Review carefully before installing. Only use this after removing the bundled deliverable/job scripts and exposed token, requiring a real user-provided or OS-backed secret for key storage, adding clear mainnet transfer confirmations, and declaring the needed filesystem, environment, network, and wallet-operation capabilities.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (5)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
submit_deliverable_submit.js:3- Finding
Bundled Scripts Perform Undisclosed Authenticated Operations Against a Fixed External Job
- Content
View full analysis
{ console.log(`Status: ${res.statusCode}`); console.log(`Headers: ${JSON.stringify(res.headers)}`); res.setEncoding('utf8'); let responseData = ''; res.on('data', (chunk) => { responseData += chunk; }); res.on('end', () => { console.log('Response:', responseData); }); }); req.on('error', (error) => { console.error('Error:', error); }); req.write(data); req.end(); ``` The other listed scripts query alternative endpoints or submit to the same fixed job identifier. ### Technical Analysis The declared skill functionality is management of NEAR wallet accounts. However, the package also includes scripts that make authenticated requests concerning a fixed job on `market.near.ai`. This behavior is not described in `SKILL.md` or declared as a skill capability in `skill.yaml`. These scripts are not automatically imported by `src/index.js`, which limits automatic exposure. Nevertheless, each script executes its network operation immediately when run because its request logic is at mod ...[truncated 1515 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
src/index.js:25- Finding
Wallet Private Keys Are Encrypted with a Publicly Known Default Key
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
src/index.js:34- Finding
Credential Storage Uses Unauthenticated CBC Encryption and Does Not Enforce Restrictive File Permissions
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
src/index.js:303- Finding
Mainnet Fund Transfers Execute Without a Transaction-Bound Confirmation Step
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (42)
Context-Inappropriate Capability
Critical
- Category
- Not specified by scanner
- Confidence
- 100% confidence
- Finding
The code contains a hardcoded bearer token for an external API and uses it to authenticate requests, creating an embedded secret and an unjustified external capability. Hardcoded live credentials can be stolen, reused, or abused by anyone with access to the code, and their presence in a skill unrelated to marketplace job submission strongly indicates unauthorized behavior.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README documents transfers on NEAR mainnet without an explicit warning that these operations move real funds and are typically irreversible once submitted. In a multi-account management skill, this omission makes accidental self-loss, wrong-recipient transfers, and misuse by inexperienced users more likely, especially because the tool can switch active accounts and operate on mainnet by default.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The reported behavior shows external job/deliverable submission unrelated to the advertised wallet/account operations, which is a classic description-behavior mismatch. Because the skill asks users to trust it with private-key workflows, unrelated outbound submission logic substantially raises the risk of credential theft or covert misuse.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The reported behavior shows external job/deliverable submission unrelated to the advertised wallet/account operations, which is a classic description-behavior mismatch. Because the skill asks users to trust it with private-key workflows, unrelated outbound submission logic substantially raises the risk of credential theft or covert misuse.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The reported behavior shows external job/deliverable submission unrelated to the advertised wallet/account operations, which is a classic description-behavior mismatch. Because the skill asks users to trust it with private-key workflows, unrelated outbound submission logic substantially raises the risk of credential theft or covert misuse.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The reported behavior shows external job/deliverable submission unrelated to the advertised wallet/account operations, which is a classic description-behavior mismatch. Because the skill asks users to trust it with private-key workflows, unrelated outbound submission logic substantially raises the risk of credential theft or covert misuse.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The reported behavior shows external job/deliverable submission unrelated to the advertised wallet/account operations, which is a classic description-behavior mismatch. Because the skill asks users to trust it with private-key workflows, unrelated outbound submission logic substantially raises the risk of credential theft or covert misuse.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The reported behavior shows external job/deliverable submission unrelated to the advertised wallet/account operations, which is a classic description-behavior mismatch. Because the skill asks users to trust it with private-key workflows, unrelated outbound submission logic substantially raises the risk of credential theft or covert misuse.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This file performs outbound calls to a live marketplace API and attempts to submit a deliverable, which is unrelated to the declared NEAR multi-account management functionality. In a skill handling accounts and credentials, unrelated external job-submission logic is suspicious because it can exfiltrate data, abuse embedded credentials, or perform unauthorized actions under the operator's identity.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The code contains marketplace job submission capability, including a fixed host, job-specific paths, and authorization for a remote service, with no connection to multi-account NEAR management. This hidden or unjustified capability materially increases risk because the skill can act on an external account or workflow without the user's informed approval.
- Content
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 100% confidence
- Finding
A hard-coded bearer token is embedded directly in source code, exposing a live credential that can be reused by anyone with access to the file. In this context, the token authorizes calls to a marketplace API unrelated to the skill's purpose, creating immediate risk of unauthorized API access, account abuse, and persistence of secret leakage through source control history.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file’s behavior is unrelated to the declared purpose of secure NEAR multi-account management and instead makes an outbound request to a third-party job-status endpoint. This kind of capability mismatch is a strong indicator of hidden or unauthorized functionality, especially in a security-sensitive skill that users would expect to manage credentials and accounts rather than contact an external service.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The code embeds a live bearer token directly in source and uses it to access an external API unrelated to the stated skill purpose. Hardcoded secrets are immediately recoverable by anyone with file access and can enable unauthorized API access, account abuse, billing loss, or further compromise of external systems tied to that token.
- Content
Known Vulnerable Dependency: base-x==2.0.6 — 1 advisory(ies): CVE-2025-27611 (Homograph attack allows Unicode lookalike characters to bypass validation.)
High
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The project includes base-x 2.0.6, which is flagged for a homograph/Unicode lookalike bypass issue. In a NEAR multi-account manager, base58-encoded identifiers and keys are security-relevant, so any ambiguity or validation bypass in encoding/decoding libraries can increase the chance of spoofed addresses, mis-bound accounts, or user deception.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest describes encrypted credential storage and NEAR transfers but provides no user-facing warning that these actions involve private key handling and potentially irreversible movement of funds. In the context of a multi-account blockchain wallet skill, omission of these warnings makes misuse more dangerous because users may not realize they are authorizing high-risk financial operations.
- Content
Scope Creep
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest declares no capabilities even though the skill is explicitly designed to store account credentials, switch active accounts, query balances, and transfer funds. This creates a dangerous mismatch between the declared trust boundary and the actual behavior, which can bypass capability-based review, mislead operators, and allow a highly sensitive wallet-management skill to be installed or approved with insufficient scrutiny.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill stores NEAR private keys on disk in a locally encrypted file, but the encryption relies on a fallback default key of 'default-key-change-in-production'. That means secrets may be recoverable by any local process or attacker who can access the filesystem and knows or guesses the default, making credential theft and wallet compromise likely.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill metadata describes account management and balance aggregation, but the implementation also includes a live on-chain transfer capability. This mismatch is dangerous because users or supervising agents may grant trust based on a read/manage-only description, while the code can spend funds irreversibly.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The transfer entrypoint can immediately submit an irreversible on-chain transaction once called, without any explicit confirmation token, secondary approval, or transaction preview. In an agent skill context, this is especially dangerous because prompt injection, tool misuse, or ambiguous instructions could trigger real fund movement with no safety interlock.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This script makes an outbound POST request to an external marketplace endpoint to submit a deliverable, which is unrelated to the declared purpose of NEAR multi-account management. In the context of a wallet/account-management skill, hidden external submission behavior is highly suspicious because it introduces unauthorized network actions and could be used to exfiltrate data or abuse external services under the user's environment.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The file is a standalone submission script that posts data to an external marketplace endpoint, which is unrelated to the declared NEAR multi-account management purpose. This creates an undisclosed outbound data flow and indicates the skill may perform actions on behalf of the author or exfiltrate information under the guise of normal functionality.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 100% confidence
- Finding
The script contains a hardcoded bearer token and automatically performs an authenticated POST request to an external service without any user warning or confirmation. Hardcoded credentials are directly exploitable by anyone with code access, and the silent authenticated submission behavior enables unauthorized actions, account abuse, and possible follow-on compromise of the associated marketplace account.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This file does not implement the advertised NEAR multi-account functionality at all; instead, it performs an authenticated outbound submission to a third-party service. That mismatch is dangerous because it suggests deceptive behavior and creates an undisclosed exfiltration/action channel that can be triggered under the guise of a wallet-management skill.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The README instructs users to supply a raw private key directly to the skill and discusses account export/storage, but it does not clearly warn that these credentials are highly sensitive and may be exposed through shell history, logs, copied prompts, screenshots, backups, or local compromise. In a cryptocurrency wallet context, weak guidance around credential handling increases the chance of account takeover and loss of funds if users handle secrets insecurely.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 85% confidence
- Finding
The skill advertises capabilities involving sensitive credentials and environment-based encryption keys, but it declares no explicit tool scope or permissions. In an agent setting, missing scope declarations weakens reviewability and least-privilege controls, especially for a skill that may access secrets from the environment.
- Content
Static analysis
No suspicious patterns detected.