Arc Security - Agent Trust Protocol

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:39 AM UTC
• Version: 1.0.1

Overview

This skill appears related to its stated blockchain-security purpose, but it can sign wallet transactions and install downloaded ZIP packages without enough safeguards.

Review carefully before installing. Use only a dedicated low-value testnet wallet, verify the configured RPC, contract, and x402 server, and do not run payment, staking, voting, claim, withdrawal, or package-use commands unless you can inspect the exact amount, chain, destination, and downloaded package contents.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (23)

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The method is documented and named as if it retrieves a genuine CCTP attestation, but it actually returns hardcoded placeholder message and attestation bytes after a sleep. In a cross-chain transfer client, this can mislead downstream code into attempting completion with invalid data, causing failed transactions, operational confusion, or unsafe assumptions about asset movement and settlement state.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The module is presented as a security-oriented skill, but it also initiates financially sensitive actions including paid skill acquisition, staking, claim submission, voting, and earnings withdrawal. This mismatch can mislead users or downstream agents into granting trust or executing the tool in contexts where only passive inspection was expected, increasing the risk of unintended on-chain transactions.

Intent-Code Divergence

Low

• Confidence: 84% confidence
• Finding: The function claims to check bond status and trust score, but it also outputs a strong security conclusion of 'Safe to use' when not flagged. That label may cause users to over-trust a skill based on incomplete heuristics such as stake, usage, and auditor count, which are not equivalent to a real security review.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The client downloads a ZIP from a remote server and extracts it directly onto the local filesystem after payment, with no integrity verification, trust validation, or path-safety checks. A malicious or compromised server can deliver a crafted archive containing arbitrary files or path traversal entries, leading to overwriting local files and planting code or configuration for later execution.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README advertises commands that can trigger on-chain payments, staking, reporting, and withdrawals, but it does not warn users that these actions may move funds, incur fees, or be irreversible once submitted to the blockchain. In a security-related skill, omission of transaction-risk disclosures increases the chance of accidental financial loss because users may treat example commands as harmless queries rather than state-changing operations.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README instructs users to set a PRIVATE_KEY environment variable for transactions but provides no guidance on secure handling, storage, or the risks of exposing that credential. A wallet private key is a highly sensitive secret; if mishandled through shell history, logs, shared environments, or misconfigured systems, an attacker could take full control of the wallet and steal funds or perform unauthorized transactions.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation instructs users to provide a wallet private key but does not include any warning about secret handling, secure storage, or the risks of exposing that key to the CLI or environment. In a skill that performs signing, payments, and cross-chain operations, compromise of this key could directly lead to unauthorized transactions and loss of funds.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The `use` command is described as automatically selecting a payment path, paying a usage fee, and downloading a remote skill package, but it does not warn users that this will trigger on-chain transactions and retrieve executable or installable content from a remote server. In the context of an agent skill marketplace, framing a skill as 'safe to use' based on trust scoring can increase the chance that users execute paid downloads without adequately reviewing transaction details or package integrity.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The submit_claim method directly signs and broadcasts a state-changing blockchain transaction as soon as it is called, with no built-in confirmation, fee disclosure, or clear indication that funds or account state may be affected. In an agent or skill context, this can cause unintended on-chain actions if higher-level code invokes the method based on ambiguous user input or prompt injection.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The vote_on_claim method performs an on-chain vote immediately after invocation and signs it with the loaded private key without any visible user disclosure. In an agent setting, hidden execution of governance or dispute-resolution actions is risky because a user may not realize they are authorizing an irreversible blockchain vote and paying transaction fees.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The claim_earnings method triggers a state-changing transaction that may move value or alter entitlement state, yet it provides no warning about fees, destination chain effects, or irreversibility. In a skill integrating wallet-like behavior, silent execution of claims increases the risk of accidental asset movement or user confusion about why a transaction occurred.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code submits a destination-chain transaction using the configured private key without any confirmation, policy checks, or validation that the supplied message and attestation correspond to an expected transfer. In an agent skill context, automatic transaction submission is more dangerous because untrusted inputs or orchestration mistakes can trigger unintended on-chain actions and gas expenditure.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The vote submission path sends an on-chain vote immediately after a minimal eligibility check, without asking the user to confirm the action or warning that it is irreversible and may carry governance or economic consequences. In a CLI that otherwise confirms sensitive actions, this inconsistency makes accidental or automated submission more likely.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill exposes extremely generic command triggers such as "use" and "check", which are common words likely to appear in unrelated conversations. In agent environments that auto-route or invoke skills based on trigger matching, this can cause unintended activation of a security-sensitive blockchain/payment skill, increasing the chance of accidental transactions, state changes, or disclosure of wallet- or contract-related context.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code writes and extracts downloaded ZIP content automatically without warning or confirmation, turning a network response into local file system changes with no user checkpoint. In the context of a skill client, this significantly increases the risk of silent installation of untrusted content and makes compromise easier if the server or transport path is malicious.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This code signs and broadcasts blockchain approval and payment transactions automatically based on server-provided payment terms, with only status prints as disclosure. Because blockchain actions are irreversible and the approval step grants token spending authority, a malicious or compromised service can induce unintended on-chain spending without meaningful user consent or review.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The CCTP branch performs a cross-chain burn/payment workflow and final authorization transaction automatically, again without strong user disclosure or approval. Cross-chain payments are complex and irreversible, so hiding them behind a normal skill request materially increases the chance of unauthorized fund loss if the remote endpoint manipulates requested payment details.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

web3>=6.0.0
requests>=2.31.0
python-dotenv>=1.0.0

• Confidence: 94% confidence
• Finding: web3>=6.0.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

web3>=6.0.0
requests>=2.31.0
python-dotenv>=1.0.0

• Confidence: 96% confidence
• Finding: requests>=2.31.0

Unpinned Dependencies

Low

• Category: Supply Chain

Content

web3>=6.0.0
requests>=2.31.0
python-dotenv>=1.0.0

• Confidence: 91% confidence
• Finding: python-dotenv>=1.0.0

Known Vulnerable Dependency: web3==6.0.0 — 1 advisory(ies): CVE-2026-40072 (web3.py: SSRF via CCIP Read (EIP-3668) OffchainLookup URL handling)

Low

• Category: Supply Chain
• Confidence: 82% confidence
• Finding: web3==6.0.0

Known Vulnerable Dependency: requests==2.31.0 — 5 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +2 more

Medium

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: requests==2.31.0

Known Vulnerable Dependency: python-dotenv==1.0.0 — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low

• Category: Supply Chain
• Confidence: 80% confidence
• Finding: python-dotenv==1.0.0

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.