Security audit

Near Subaccount

Security checks across malware telemetry and agentic risk

Overview

This skill matches its NEAR account-management purpose, but it can run unvalidated shell commands and perform account deletion or bulk token transfers without confirmation.

Review this before installing if you will connect it to any real NEAR account. Use only low-value or test accounts, manually inspect recipient JSON files, verify every account ID and amount, and avoid automated delete or distribute runs until the skill adds validation, dry-run previews, and explicit confirmations.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 79% confidence
Finding: The skill instructs users to rely on an environment variable (`NEAR_ACCOUNT`) but does not declare that environmental access/capability up front. Undeclared capability use weakens transparency and consent, and in an agent setting can cause the skill to act with credentials or account context the user did not explicitly authorize.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The script builds shell command strings with untrusted inputs such as subaccount names, account IDs, file-derived recipient IDs, and amounts, then executes them via child_process.exec. This creates a command injection risk that could let an attacker execute arbitrary shell commands on the host, which is more severe than merely using the NEAR CLI instead of a direct API.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README documents destructive account deletion and fund distribution operations without any warning about irreversibility, required confirmations, testnet use, or the risk of transferring real funds. In a wallet/account-management skill, omitting cautions materially increases the chance of operator error and unintended loss, even if the file itself does not execute code.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill describes irreversible and fund-moving operations such as deleting subaccounts and bulk distributing NEAR without any warning, confirmation, limits, or cautionary guidance. In a financial context, this materially increases the chance of accidental asset loss, misdirected transfers, or destructive actions being triggered by a user or downstream agent without understanding the consequences.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The distribute command performs multiple value transfers immediately after reading a JSON file, without a dry-run summary, recipient review, or interactive confirmation. In a financial-management skill, this increases the risk of operator error, malformed input, or maliciously supplied recipient lists causing irreversible fund transfers.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The delete command irreversibly deletes a subaccount and transfers remaining funds to a beneficiary without any confirmation prompt or safety interlock. In the context of account administration, a typo, bad automation input, or social engineering could cause unintended destructive actions that are difficult to recover from.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.