Security audit

Lance

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Web3 audit/reporting skill with local helper scripts and no hidden exfiltration or persistence, though users should note its implicit invocation settings and unpinned GitHub install instructions.

Install from a reviewed commit or signed release when possible, and consider disabling implicit invocation unless you want this skill automatically selected for Web3 audit prompts. Only use it on targets where you have authorization, since it is designed to produce exploitability-focused security findings.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: README.md:114
Finding: Unpinned Skill Installation from a Mutable Personal Repository
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (30)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description presents this skill as a security auditing agent that discovers and validates Web3 vulnerabilities across smart contracts and protocols, with strict exploitability and triage gating. The supplied code does not perform any analysis, auditing, scanning, bytecode/source review, or vulnerability discovery. Instead, it simply loads an existing finding from JSON, selects the first finding if a list is present, and renders it into markdown templates tailored to specific bug bounty platforms. While reporting is part of the declared purpose, the primary behavior of the code is much narrower and materially different: report formatting only. Therefore, the description overstates the implemented capabilities, making this a clear mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description promises an active Web3 security auditing agent capable of vulnerability discovery and triaged reporting across multiple blockchain/security domains. The supplied code does not perform any auditing, scanning, exploit analysis, protocol review, or bounty workflow logic. Instead, it is a post-processing adapter that ingests already-produced JSON findings from another tool ('invariant') and maps them into a standardized schema. While this may support a larger audit pipeline, the code chunk's primary purpose is materially narrower and different from the declared purpose, so this is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a full Web3 security auditing agent focused on discovering and reporting exploitable vulnerabilities in smart contracts, DeFi protocols, wallets, bridges, EVM bytecode, and Sui Move packages. The supplied code does not perform any security analysis at all. It only classifies target strings by simple heuristics, optionally loads a scope JSON file, and emits a normalized manifest. This is a materially different primary purpose: input preprocessing for targets rather than bug finding or bounty triage. While target normalization could be a supporting component within a larger auditing workflow, this chunk by itself does not implement the described agent behavior, so the description does not accurately represent the code.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description presents a security analysis agent focused on finding and triaging exploitable Web3 vulnerabilities. The supplied code does not inspect smart contracts or protocol logic at all. Instead, it reads markdown/text scope files and performs keyword/regex-based extraction of bounty program metadata and rules. While the script is loosely related to the Web3 bug bounty domain, its primary purpose is parsing program scope documentation, not auditing targets for vulnerabilities. Therefore the description materially overstates and misrepresents the actual behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a broad Web3 security auditing agent focused on vulnerability discovery across smart contracts, DeFi protocols, wallet flows, bridges, EVM bytecode, Solidity repos, and Sui Move packages. The supplied code does not perform any of those audit or discovery tasks. Instead, it is a narrow triage simulator: it reads JSON findings, applies fixed heuristic rules to determine whether evidence is sufficient, and emits a triage verdict. While this is loosely related to the description’s claim about strict triage gates, that is only one downstream aspect of the declared system. The code’s primary behavior is materially narrower and different from the declared purpose, so this is a mismatch.
Content: No source excerpt is available for this finding.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · references/audit-rules.md (reported line 45)May include surrounding context.
md
- required market conditions are unlikely - impact is minor or self-harm-only ## Final Output Rule Only include findings that pass all gates. If none pass, output:

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · CHANGELOG.md (reported line 1)May include surrounding context.
md
# Vault Share Inflation ## Hunt Targets

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/vulnerabilities/access-control.md (reported line 1)May include surrounding context.
md
# Vault Share Inflation ## Hunt Targets

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/vulnerabilities/accounting-invariant-break.md (reported line 1)May include surrounding context.
md
# Vault Share Inflation ## Hunt Targets

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/vulnerabilities/amm-invariant-violation.md (reported line 1)May include surrounding context.
md
# Vault Share Inflation ## Hunt Targets

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/vulnerabilities/bridge-replay.md (reported line 1)May include surrounding context.
md
# Vault Share Inflation ## Hunt Targets

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/vulnerabilities/flash-loan-manipulation.md (reported line 1)May include surrounding context.
md
# Vault Share Inflation ## Hunt Targets

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/vulnerabilities/governance-flash-loan.md (reported line 1)May include surrounding context.
md
# Vault Share Inflation ## Hunt Targets

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/vulnerabilities/move-capability-abuse.md (reported line 1)May include surrounding context.
md
# Vault Share Inflation ## Hunt Targets

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/vulnerabilities/move-shared-object-race.md (reported line 1)May include surrounding context.
md
# Vault Share Inflation ## Hunt Targets

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/vulnerabilities/oracle-manipulation.md (reported line 1)May include surrounding context.
md
# Vault Share Inflation ## Hunt Targets

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/vulnerabilities/reentrancy.md (reported line 1)May include surrounding context.
md
# Vault Share Inflation ## Hunt Targets

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/vulnerabilities/signature-replay.md (reported line 1)May include surrounding context.
md
# Vault Share Inflation ## Hunt Targets

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/vulnerabilities/upgradeability-storage-collision.md (reported line 1)May include surrounding context.
md
# Vault Share Inflation ## Hunt Targets

Hidden Instructions

High

Category: Prompt Injection
Confidence: 60% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/vulnerabilities/vault-share-inflation.md (reported line 1)May include surrounding context.
md
# Vault Share Inflation ## Hunt Targets

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · scripts/parse_web3_scope.py (reported line 174)May include surrounding context.
python
low = line.lower() if any(m in low for m in markers): rules.append(line.strip()) return rules def main() -> None:

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill enables allow_implicit_invocation without any trigger constraints, exclusions, or narrowing conditions, which means the agent may auto-select this skill in contexts the user did not explicitly intend. Because this skill is a high-trust security auditing tool for Web3 targets, unintended invocation can cause over-broad analysis, prompt-scope expansion, and increase the attack surface for prompt injection or misuse through crafted user inputs.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill enables allow_implicit_invocation without any visible trigger constraints or narrowing conditions, which can cause the agent to invoke a high-impact Web3 security workflow in unintended contexts. Because this skill is designed for exploitability-focused protocol analysis, accidental or overly broad activation could expose sensitive code, steer conversations into risky security guidance, or amplify prompt-injection exposure from untrusted artifacts.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill enables implicit invocation, allowing it to be triggered automatically based on broad user intent rather than an explicit, narrowly scoped request. Because this skill is a security auditing agent with authority to assess vulnerabilities in untrusted code, broad auto-invocation increases the chance it will process adversarial content unexpectedly, amplifying prompt-injection and unsafe tool-routing risk.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.