Lance

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 12:27 AM UTC
• Version: 0.0.1

Overview

This is a coherent Web3 audit/reporting skill with local helper scripts and no hidden exfiltration or persistence, though users should note its implicit invocation settings and unpinned GitHub install instructions.

Install from a reviewed commit or signed release when possible, and consider disabling implicit invocation unless you want this skill automatically selected for Web3 audit prompts. Only use it on targets where you have authorization, since it is designed to produce exploitability-focused security findings.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:114
• Finding: Unpinned Skill Installation from a Mutable Personal Repository<![CDATA[ ## Vulnerability Details **File Location**: `README.md:114-116` **Vulnerability Type**: Supply-chain risk from an unpinned external source **Risk Level**: Medium ### Vulnerable Code ```bash git clone https://github.com/shaniidev/lance .cursor/skills/lance git clone https://github.com/shaniidev/lance .claude/skills/lance git clone https://github.com/shaniidev/lance .agents/skills/lance ``` ### Technical Analysis The documented installation commands clone the current default branch of a personally controlled GitHub repository directly into Agent Skill directories. They do not select an immutable commit or verified release and do not perform signature or checksum verification. Consequently, the effective Skill content installed by a user can differ from the version previously reviewed. If the upstream repository or maintainer account is compromised, an attacker could replace the Skill instructions or Python scripts with malicious content. Installing that mutable content into an agent-recognized skills directory increases the risk that it will subsequently be loaded or invoked with the agent's available tools and permissions. The repository URL is consistent with the author and source metadata, and the audited snapshot contained no malicious payload. The issue is therefore an unsafe supply-chain installation pattern rather than evidence that the current maintainer or repository is malicious. ### Attack Path 1. An attacker compromises the upstream GitHub account, repository, or publishing workflow. 2. The attacker modifies the default branch by adding malicious Skill instructions or executable scripts. 3. A user follows one of the documented `git clone` commands without selecting a reviewed commit. 4. Git retrieves the attacker-modified default branch and places it directly in an Agent Skill directory. 5. The affected agent discovers and loads the modified Skill, or the user invokes one of its altered scripts. 6. The malicious content operates wi ...[truncated 704 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Publish reviewed, immutable releases and direct users to a specific release tag or commit rather than the mutable default branch. 2. Document a pinned installation procedure, such as cloning the repository and checking out a full reviewed commit hash. 3. Sign release tags or artifacts and publish SHA-256 checksums through a separately protected release process. 4. Require users to verify the signature or checksum before placing the content in an Agent Skill directory. 5. Prefer downloading a versioned release archive only after verifying its integrity and provenance. 6. Recommend reviewing changes to `SKILL.md`, agent configuration files, and `scripts/` before enabling or updating the Skill. 7. Configure supported agents to require explicit approval before newly installed or updated skills execute scripts or receive sensitive tools. 8. Avoid automatic updates from the upstream default branch; updates should repeat the same pinning, review, and verification process. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (30)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents this skill as a security auditing agent that discovers and validates Web3 vulnerabilities across smart contracts and protocols, with strict exploitability and triage gating. The supplied code does not perform any analysis, auditing, scanning, bytecode/source review, or vulnerability discovery. Instead, it simply loads an existing finding from JSON, selects the first finding if a list is present, and renders it into markdown templates tailored to specific bug bounty platforms. While reporting is part of the declared purpose, the primary behavior of the code is much narrower and materially different: report formatting only. Therefore, the description overstates the implemented capabilities, making this a clear mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description promises an active Web3 security auditing agent capable of vulnerability discovery and triaged reporting across multiple blockchain/security domains. The supplied code does not perform any auditing, scanning, exploit analysis, protocol review, or bounty workflow logic. Instead, it is a post-processing adapter that ingests already-produced JSON findings from another tool ('invariant') and maps them into a standardized schema. While this may support a larger audit pipeline, the code chunk's primary purpose is materially narrower and different from the declared purpose, so this is a clear description-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared description presents a full Web3 security auditing agent focused on discovering and reporting exploitable vulnerabilities in smart contracts, DeFi protocols, wallets, bridges, EVM bytecode, and Sui Move packages. The supplied code does not perform any security analysis at all. It only classifies target strings by simple heuristics, optionally loads a scope JSON file, and emits a normalized manifest. This is a materially different primary purpose: input preprocessing for targets rather than bug finding or bounty triage. While target normalization could be a supporting component within a larger auditing workflow, this chunk by itself does not implement the described agent behavior, so the description does not accurately represent the code.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description presents a security analysis agent focused on finding and triaging exploitable Web3 vulnerabilities. The supplied code does not inspect smart contracts or protocol logic at all. Instead, it reads markdown/text scope files and performs keyword/regex-based extraction of bounty program metadata and rules. While the script is loosely related to the Web3 bug bounty domain, its primary purpose is parsing program scope documentation, not auditing targets for vulnerabilities. Therefore the description materially overstates and misrepresents the actual behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared description presents a broad Web3 security auditing agent focused on vulnerability discovery across smart contracts, DeFi protocols, wallet flows, bridges, EVM bytecode, Solidity repos, and Sui Move packages. The supplied code does not perform any of those audit or discovery tasks. Instead, it is a narrow triage simulator: it reads JSON findings, applies fixed heuristic rules to determine whether evidence is sufficient, and emits a triage verdict. While this is loosely related to the description’s claim about strict triage gates, that is only one downstream aspect of the declared system. The code’s primary behavior is materially narrower and different from the declared purpose, so this is a mismatch.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

- required market conditions are unlikely
- impact is minor or self-harm-only

## Final Output Rule

Only include findings that pass all gates.
If none pass, output:

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Hidden Instructions

High

• Category: Prompt Injection

Content

# Vault Share Inflation

## Hunt Targets

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# Vault Share Inflation

## Hunt Targets

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# Vault Share Inflation

## Hunt Targets

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# Vault Share Inflation

## Hunt Targets

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# Vault Share Inflation

## Hunt Targets

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# Vault Share Inflation

## Hunt Targets

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# Vault Share Inflation

## Hunt Targets

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# Vault Share Inflation

## Hunt Targets

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# Vault Share Inflation

## Hunt Targets

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# Vault Share Inflation

## Hunt Targets

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# Vault Share Inflation

## Hunt Targets

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# Vault Share Inflation

## Hunt Targets

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# Vault Share Inflation

## Hunt Targets

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

# Vault Share Inflation

## Hunt Targets

• Confidence: 60% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

low = line.lower()
        if any(m in low for m in markers):
            rules.append(line.strip())
    return rules


def main() -> None:

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill enables allow_implicit_invocation without any trigger constraints, exclusions, or narrowing conditions, which means the agent may auto-select this skill in contexts the user did not explicitly intend. Because this skill is a high-trust security auditing tool for Web3 targets, unintended invocation can cause over-broad analysis, prompt-scope expansion, and increase the attack surface for prompt injection or misuse through crafted user inputs.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill enables allow_implicit_invocation without any visible trigger constraints or narrowing conditions, which can cause the agent to invoke a high-impact Web3 security workflow in unintended contexts. Because this skill is designed for exploitability-focused protocol analysis, accidental or overly broad activation could expose sensitive code, steer conversations into risky security guidance, or amplify prompt-injection exposure from untrusted artifacts.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The skill enables implicit invocation, allowing it to be triggered automatically based on broad user intent rather than an explicit, narrowly scoped request. Because this skill is a security auditing agent with authority to assess vulnerabilities in untrusted code, broad auto-invocation increases the chance it will process adversarial content unexpectedly, amplifying prompt-injection and unsafe tool-routing risk.

Static analysis

No suspicious patterns detected.