Gas Fee Tracker

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:19 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward gas fee tracker that queries public blockchain RPC endpoints and optionally writes a user-selected log file.

Install and run it in a virtual environment if possible, and consider pinning requests before use. Be aware that running the script contacts public RPC endpoints and that --log appends gas snapshots to the file path you provide.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: README.md:25

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 25-27
Vulnerability Type: Unpinned third-party dependency
Risk Level: Low

text

pip install requests

Technical Analysis

The installation command retrieves the latest available version of requests and its transitive dependencies without a version constraint, lockfile, or package hash verification. Consequently, the dependency set can change after the project has been reviewed.

This is a supply-chain hardening weakness rather than evidence that the current requests package is malicious. If a future dependency release or package-distribution account were compromised, users following this instruction could install attacker-controlled code. Unpinned versions can also introduce incompatible changes that alter or break the Skill's behavior.

Attack Path

1. An attacker compromises a relevant package release or its distribution account.
2. The attacker publishes a malicious release that satisfies the unconstrained installation command.
3. A user follows the README and runs pip install requests.
4. pip resolves and installs the compromised package or transitive dependency.
5. Malicious code executes during package installation or when the package is imported by scripts/gas_tracker.py.

This path depends on an upstream supply-chain compromise; the audited project does not itself retrieve or execute a remote code payload.

Impact Assessment

Malicious dependency code would generally execute with the privileges of the user running pip or launching the Skill. It could access files and credentials available to that account, make network requests, modify user-writable data, or execute additional processes. The scope could be greater if installation is performed with elevated privileges. No direct privilege-escalation mechanism is present in the audited project.

Remediation

View remediation

Remediation Suggestions

• Add a reviewed dependency file that pins requests and all transitive dependencies to exact versions.
• Generate and verify cryptographic hashes, for example with pip-compile --generate-hashes.
• Install with hash enforcement:

  bash

  python3 -m pip install --require-hashes -r requirements.txt
  

• Recommend installation inside a dedicated virtual environment rather than into the system Python environment.
• Use automated dependency scanning and controlled update reviews to keep pinned versions secure without silently accepting new releases.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill documentation describes capabilities that perform network access to public RPC endpoints and optional file writes to a JSONL log, but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. This creates a least-privilege and review gap: an operator may approve or run the skill without clear visibility into its external communication and local write behavior, making misuse or later code changes harder to govern.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/gas_tracker.py (reported line 46)May include surrounding context.

python

def fetch_gas_price_gwei(rpc_url: str, timeout=10) -> float:
    resp = requests.post(
        rpc_url,
        json={"jsonrpc": "2.0", "method": "eth_gasPrice", "params": [], "id": 1},
        timeout=timeout,

Static analysis

No suspicious patterns detected.