Security audit

区块链安全基础版

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to provide blockchain safety lookups, but it asks for broad command execution and includes unrelated automation scope that users should review before installing.

Install only if you are comfortable with a skill that may use shell commands for API calls and may send a client fingerprint or fallback IP/User-Agent data for quota tracking. Prefer a version that removes exec, narrows triggers to Ethereum/Base address and token checks, and documents fingerprint privacy handling.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The skill markets the free edition as a read-only blockchain security checker, yet its declared capabilities include `exec`, which enables arbitrary command execution unrelated to the stated purpose. This mismatch can cause an agent platform to grant far broader privileges than users expect, increasing the risk of command execution, local data access, or abuse if the skill is invoked automatically.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: A blockchain address/token reputation API does not need arbitrary shell execution to perform simple HTTP-based lookups, so exposing `exec` is unjustified and materially expands the attack surface. In an agent environment, this can let prompts or downstream flows pivot from benign security checks into OS command execution, secret access, or persistence actions.

Description-Behavior Mismatch

Medium

Confidence: 86% confidence
Finding: The document frames the skill as a narrowly scoped blockchain security API, but later claims unrelated capabilities such as cross-platform data sync, unstructured data extraction, and operations automation. This scope inflation can mislead routing systems and users into granting trust or broader usage contexts than warranted, which is especially risky when paired with `exec`.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: Claiming the skill can automate system commands and handle unrelated data-processing tasks contradicts its earlier description as a blockchain security API. In practice, this broadens the perceived authorization boundary and may encourage unsafe invocation in contexts where command execution or local system interaction was never intended.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The invocation language is overly broad, indicating the skill should be used whenever security detection, compliance audit, quality inspection, or encryption protection is needed. Such generic triggers can cause the skill to activate for many unrelated requests, increasing unnecessary data transmission to the external service and exposing users to the skill's over-privileged tool set.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The phrase instructing use whenever users need 'blockchain security basic edition related functions' is circular and generic rather than defining clear activation boundaries. In agent ecosystems, vague trigger text can cause over-selection of the skill and unintended use in broader workflows than necessary.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill instructs clients to send an `X-Client-Fingerprint` header to identify users for quota tracking, but it does not present a clear privacy warning or data-handling disclosure. Fingerprinting data can be identifying or linkable across sessions, so silent transmission to an external API creates privacy and compliance risk.

Static analysis

No suspicious patterns detected.