Security audit

PRISM OS SDK

Security checks for vulnerabilities and agentic risk

Overview

The skill is advertised as read-only financial data, but the inspected code includes account key management and transaction-related capabilities that deserve review before installation.

Install only if you are comfortable giving this package a PRISM API key and reviewing its non-read-only capabilities. Avoid using production credentials with a custom baseUrl, do not let an agent invoke developer key-management methods unattended, and treat any execution, webhook, or watch functionality as higher-risk remote account activity rather than passive market-data lookup.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: src/modules/developer-agent.ts:28
Finding: Read-Only Skill Exposes Account Credential Management Operations
Content: View full analysis
{ return this.c.post('/auth/keys', params); } /** List your API keys */ async listKeys(include_revoked = false): Promise { return this.c.get('/auth/my/keys', { params: { include_revoked } }); } /** Revoke an API key */ async revokeKey(keyId: string): Promise { // DELETE — use post trick with method override, or add delete to client if needed await this.c.get(`/auth/my/keys/${encodeURIComponent(keyId)}`); } /** Rotate an API key (get a new secret) */ async rotateKey(keyId: string): Promise<{ key: string; [k: string]: unknown }> { return this.c.post(`/auth/my/keys/${encodeURIComponent(keyId)}/rotate`, {}); } /** Verify an API key is valid */ async verifyKey(key: string): Promise<{ valid: boolean; tier?: string; [k: string]: unknow ...[truncated 1818 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: src/modules/dex/index.ts:123
Finding: Compiled Modules Support Signed Transaction Broadcasting and Financial Execution Despite Read-Only Claims
Content: View full analysis
{ const quote = await this.getQuote(params); return this.client.post('/dex/build-tx', { quoteId: quote.quoteId, ...params }); } /** * Dry run — preview exactly what will happen without executing */ async simulateSwap(params: SwapParams): Promise<{ willSucceed: boolean; expectedOutput: string; priceImpact: number; gasEstimate: string; warnings: string[]; }> { const quote = await this.getQuote(params); return this.client.post('/dex/simulate', { quoteId: quote.quoteId }); } /** * Full execution — requires a signer function or private key (handled externally) * Agent passes signed transaction back for broadcasting */ async executeSwap( params: SwapParams, signTransaction: (txData: unknown) => Promise ): Promise<{ txHash: string; status: 'success' | 'failed' | 'pending'; inputAmount: string; outputAmount: string; gasUsed: string; timestamp: number; }> { // 1. Get quote const quote = await this.getQuote(params); // 2. Build unsigned tx const txData = a ...[truncated 3288 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/core/client.ts:23
Finding: API Credential Is Forwarded to a Caller-Controlled Base URL Without HTTPS Enforcement
Content: View full analysis
): string { const url = new URL(`${this.baseUrl}${path}`); if (params) { for (const [k, v] of Object.entries(params)) { if (v !== undefined && v !== null) url.searchParams.set(k, String(v)); } } return url.toString(); } ``` GET requests transmit the credential as follows: ```ts const res = await fetch(url, { method: 'GET', headers: { 'X-API-Key': this.apiKey, 'Accept': 'application/json', 'User-Agent': 'prism-os-sdk/1.0', }, signal: controller.signal, }); ``` POST requests do the same: ```ts const res = await fetch(url, { method: 'POST', headers: { 'X-API-Key': this.apiKey, 'Content-Type': 'application/json', 'Accept': 'application/json', 'User-Agent': 'prism-os-sdk/1.0', }, body: JSON.stringify(body), signal: controller.signal, }); ``` No validation requires the destination to be `https://api.prismapi.ai`, and no check requires HTTPS. This behavior is not covert exfiltration because the caller must supply or influence the custom URL. Nevertheless, configuration injection, unsafe environment configuration, or accidental use of an HTTP endpoint can disclose the API key. The network activity flagged in `src/modules/crypto.ts` consists ...[truncated 1305 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/modules/developer-agent.ts:43
Finding: API Key Revocation Method Uses GET Instead of DELETE and May Leave Compromised Keys Active
Content: View full analysis
{ // DELETE — use post trick with method override, or add delete to client if needed await this.c.get(`/auth/my/keys/${encodeURIComponent(keyId)}`); } ``` HTTP GET should not perform destructive state changes. Unless the server implements an undocumented and unsafe GET-based revocation behavior, this request will not revoke the key. Because the method returns `Promise` and does not validate a revocation state, callers may incorrectly conclude that the credential has been disabled. ### Attack Path 1. A PRISM API key is suspected or confirmed to be compromised. 2. A user or automated incident-response agent invokes `prism.developer.revokeKey(keyId)`. 3. The SDK sends GET rather than DELETE. 4. The server returns key information, an error, or another non-revocation response. 5. The method completes without verifying that the key is revoked. 6. The user or agent assumes remediation succeeded. 7. An attacker continues using the still-active credential. ### Impact Assessment This flaw can prolong unauthorized access after credential compromise. The attacker retains whatever permissions the affected API key already possessed, potentially including: - Continued access to authenticated API endpoints. - API quota consumption. - Access to account-specific usage information. - Credential administration if the key has elevated permissions. - Execution-related ...[truncated 168 chars]
Remediation: View remediation
(path: string): Promise { const url = this.buildUrl(path); const res = await fetch(url, { method: 'DELETE', headers: { 'X-API-Key': this.apiKey, 'Accept': 'application/json', 'User-Agent': 'prism-os-sdk/1.0', }, }); if (!res.ok) { const body = await res.text().catch(() => ''); throw new PrismApiError(res.status, res.statusText, body, path); } return res.json() as Promise; } ``` 2. Implement revocation with the documented HTTP method: ```ts async revokeKey(keyId: string): Promise { await this.c.delete(`/auth/my/keys/${encodeURIComponent(keyId)}`); } ``` 3. Verify the server response explicitly indicates a revoked state. 4. Optionally perform a follow-up validation that the revoked credential is rejected. 5. Return a structured result instead of `void`, including the key ID and revocation timestamp. 6. Add integration tests covering successful revocation, nonexistent key IDs, authorization failures, and already-revoked keys. 7. Avoid method-override workarounds unless the server explicitly supports and authenticates them. ]]>

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (93)

Known Vulnerable Dependency: handlebars==4.7.8 — 8 advisory(ies): CVE-2026-33916 (Handlebars.js has Prototype Pollution Leading to XSS through Partial Template In); CVE-2026-33937 (Handlebars.js has JavaScript Injection via AST Type Confusion); CVE-2026-33938 (Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @part) +5 more

Critical

Category: Supply Chain
Confidence: 92% confidence
Finding: handlebars 4.7.8 has a long history of prototype-pollution and template/code-injection issues, and here it is pulled in transitively by ts-jest as a development dependency. While this is not direct runtime exposure, it becomes dangerous if tests, code generation, or build tooling compile attacker-controlled templates or run in shared CI environments, potentially leading to code execution or poisoned object state during the build process.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The finding suggests broad support for execution modeling, portfolios, webhook configuration, and general batch agent operations, which exceeds the declared role of a passive financial data SDK. In an agent environment, webhook and batch-operation support can create indirect outbound actions and orchestration behavior that users did not knowingly authorize.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The finding suggests broad support for execution modeling, portfolios, webhook configuration, and general batch agent operations, which exceeds the declared role of a passive financial data SDK. In an agent environment, webhook and batch-operation support can create indirect outbound actions and orchestration behavior that users did not knowingly authorize.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The finding suggests broad support for execution modeling, portfolios, webhook configuration, and general batch agent operations, which exceeds the declared role of a passive financial data SDK. In an agent environment, webhook and batch-operation support can create indirect outbound actions and orchestration behavior that users did not knowingly authorize.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The finding suggests broad support for execution modeling, portfolios, webhook configuration, and general batch agent operations, which exceeds the declared role of a passive financial data SDK. In an agent environment, webhook and batch-operation support can create indirect outbound actions and orchestration behavior that users did not knowingly authorize.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The finding suggests broad support for execution modeling, portfolios, webhook configuration, and general batch agent operations, which exceeds the declared role of a passive financial data SDK. In an agent environment, webhook and batch-operation support can create indirect outbound actions and orchestration behavior that users did not knowingly authorize.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The finding suggests broad support for execution modeling, portfolios, webhook configuration, and general batch agent operations, which exceeds the declared role of a passive financial data SDK. In an agent environment, webhook and batch-operation support can create indirect outbound actions and orchestration behavior that users did not knowingly authorize.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The finding suggests broad support for execution modeling, portfolios, webhook configuration, and general batch agent operations, which exceeds the declared role of a passive financial data SDK. In an agent environment, webhook and batch-operation support can create indirect outbound actions and orchestration behavior that users did not knowingly authorize.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The finding suggests broad support for execution modeling, portfolios, webhook configuration, and general batch agent operations, which exceeds the declared role of a passive financial data SDK. In an agent environment, webhook and batch-operation support can create indirect outbound actions and orchestration behavior that users did not knowingly authorize.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The finding suggests broad support for execution modeling, portfolios, webhook configuration, and general batch agent operations, which exceeds the declared role of a passive financial data SDK. In an agent environment, webhook and batch-operation support can create indirect outbound actions and orchestration behavior that users did not knowingly authorize.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The finding suggests broad support for execution modeling, portfolios, webhook configuration, and general batch agent operations, which exceeds the declared role of a passive financial data SDK. In an agent environment, webhook and batch-operation support can create indirect outbound actions and orchestration behavior that users did not knowingly authorize.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The finding suggests broad support for execution modeling, portfolios, webhook configuration, and general batch agent operations, which exceeds the declared role of a passive financial data SDK. In an agent environment, webhook and batch-operation support can create indirect outbound actions and orchestration behavior that users did not knowingly authorize.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The finding suggests broad support for execution modeling, portfolios, webhook configuration, and general batch agent operations, which exceeds the declared role of a passive financial data SDK. In an agent environment, webhook and batch-operation support can create indirect outbound actions and orchestration behavior that users did not knowingly authorize.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The architecture document conflicts with the stated skill metadata by describing concrete trade execution capabilities such as swap execution and transaction simulation in a supposedly read-only financial SDK. This kind of scope misrepresentation is dangerous because an agent integrator may grant trust, permissions, or deployment approval under the false assumption that the skill cannot perform state-changing financial actions.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The roadmap describes numerous execution and automation features including arbitrage, DCA, TWAP, batch execution, conditional automation, and treasury management, which materially exceed a read-only data SDK. Even if aspirational, presenting these capabilities without clear scoping can mislead agent platforms and users into underestimating the financial and operational risk of integrating the skill.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The top-level documentation frames the package as a universal finance SDK while the broader skill metadata claims a read-only finance data SDK. That contradiction matters because it can mislead reviewers and automated policy systems about the true risk profile, especially when the same file later documents execution functions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation explicitly includes prism.execute.placeOrder and related execution features, which directly contradict the skill's stated read-only, data-retrieval-only purpose. In an agent context, undocumented or unjustified trade execution materially increases the chance of unauthorized financial actions, especially if downstream systems assume the skill is safe because it is described as read-only.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Order placement is a powerful transactional capability and is unjustified in a skill presented as data retrieval only. This mismatch can cause users, agents, or approval systems to grant the skill broader trust than warranted, enabling unintended trades, financial loss, or abuse through prompt-driven invocation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill is described as a read-only financial data SDK, but this example scaffolds transactional behavior such as swap execution and DeFi deposit flow, plus ongoing monitoring. That mismatch is dangerous because an agent integrator may trust the package as non-actionable data-only software while inheriting patterns that normalize autonomous fund movement or action hooks.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==1.1.12 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: browserslist==4.28.1 — 2 advisory(ies): CVE-2026-73088 (Browserslist: Uncaught crash / prototype write via untrusted browserslist-stats.); CVE-2026-73089 (Browserslist: Unbounded memory growth (no cache eviction) via distinct query res)

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: js-yaml==3.14.2 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: minimatch==3.1.2 — 3 advisory(ies): CVE-2026-27904 (minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regu); CVE-2026-26996 (minimatch has a ReDoS via repeated wildcards with non-matching literal in patter); CVE-2026-27903 (minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adja)

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: picomatch==2.3.1 — 2 advisory(ies): CVE-2026-33672 (Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Mat); CVE-2026-33671 (Picomatch has a ReDoS vulnerability via extglob quantifiers)

High

Category: Supply Chain
Confidence: 80% confidence
Finding: Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill metadata and description present this SDK as read-only and limited to data retrieval, but the client exposes a generic POST primitive capable of sending arbitrary JSON to any configured API path. In an agent context, this creates a capability mismatch: downstream code or prompt-influenced tool use could invoke state-changing operations if supported by the backend now or in the future, violating least privilege and user expectations.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.