Graph Query Tool Free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:20 AM UTC
• Version: 1.0.3

Overview

This blockchain query skill is not malicious, but it asks for command execution and file-writing authority that is broader than its read-only stated purpose.

Install only if you are comfortable granting this skill command execution and possible file-writing ability. Prefer running it in a sandbox with read-only project access, and do not allow it to save/export files or run network diagnostics unless you explicitly asked for that action.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:41

Finding

Overprivileged Tool Declaration for a Read-Only Query Skill

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 41-44
Vulnerability Type: Excessive local tool permissions
Risk Level: Medium

Vulnerable Code:

yaml

tools:
  - read
  - exec
  - write

Technical Analysis

The Skill describes a read-only blockchain-data routing and query service, but it declares unrestricted exec and write capabilities in addition to read. The documented functionality does not establish a legitimate requirement to modify local files or execute arbitrary operating-system commands.

This violates the principle of least privilege. If the hosting Agent automatically grants the declared tools, instructions derived from a malicious user query, compromised remote data, or an Agent interpretation error could cause the Skill to execute commands or write files with the permissions of the Agent process.

The declaration does not itself prove that commands are executed automatically. Exploitation depends on the hosting platform granting these capabilities and on attacker-controlled content influencing a subsequent tool invocation.

Attack Path

1. The Agent loads the Skill and grants its declared read, exec, and write tools.
2. An attacker submits a crafted natural-language blockchain query, or a queried external service returns adversarial content.
3. The Agent interprets that content as a reason to invoke exec or write.
4. A command is run or a local file is modified outside the legitimate read-only query workflow.
5. The resulting access is limited by the operating-system privileges and sandbox boundaries of the Agent process.

Impact Assessment

Successful exploitation could permit command execution and file modification under the Agent process identity. Depending on the runtime sandbox, this may expose local project files, alter user-accessible files, corrupt outputs, or invoke network-capable programs. No evidence in the audited artifact demonstrate ...[truncated 120 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the write capability because the documented workflow does not require local file modification.
• Replace unrestricted exec access with a narrowly scoped HTTP request tool.
• Restrict outbound requests to an explicit allowlist of documented blockchain-data endpoints.
• If command execution is unavoidable, expose only fixed commands with validated arguments rather than a general shell.
• Run the Skill in a sandbox with a read-only project filesystem, restricted network access, no inherited credentials, and a low-privilege operating-system identity.
• Treat user input and remote API responses strictly as data and prohibit them from supplying commands, tool names, file paths, or executable instructions.
• Document the precise purpose of every requested capability and deny execution if the platform cannot enforce those restrictions.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:224

Finding

Unpinned Third-Party Package Installation Guidance

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 224
Vulnerability Type: Unpinned third-party dependency
Risk Level: Low

Vulnerable Code:

markdown

| requests (optional) | Python package | Optional | `pip install requests`, for more stable HTTP requests |

Technical Analysis

The setup guidance recommends installing requests without specifying an audited version, lockfile, package hash, or trusted index configuration. Package resolution therefore depends on mutable registry state at installation time.

Although requests is a well-known package and the installation is documented as optional, an unpinned installation can introduce dependency drift. If the package, one of its transitive dependencies, an index account, or the configured package source is compromised, installation may introduce attacker-controlled code. Python package installation can execute package-controlled build logic, and the installed package later executes when imported.

The audited project does not contain a dependency manifest or code that automatically runs this command. Exploitation therefore requires an operator or Agent to follow the optional installation guidance.

Attack Path

1. An operator or Agent follows the documented pip install requests instruction.
2. pip resolves the package and transitive dependencies from the currently configured package index without enforcing approved versions or hashes.
3. A compromised, substituted, or unexpectedly changed package artifact is downloaded.
4. Package-controlled installation or build behavior executes with the privileges of the invoking environment, or malicious code executes when the dependency is imported.
5. The payload gains access to resources available to that Python environment and user account.

Impact Assessment

In a successful supply-chain compromise, malicious package code could execute with the permissions of the user running pip or the ...[truncated 340 chars]

Remediation

View remediation

Remediation Suggestions

• Prefer Python's documented standard-library urllib functionality when it satisfies the requirement.
• If requests is necessary, specify an audited version in a dependency lockfile.
• Require package hashes, such as through pip install --require-hashes -r requirements.txt.
• Pin and review transitive dependencies rather than allowing unconstrained resolution.
• Use an explicitly configured trusted package index or an internally controlled package mirror.
• Install dependencies in an isolated virtual environment under a non-privileged account.
• Add automated dependency and provenance scanning to detect known vulnerabilities or unexpected artifact changes.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill declares broad create/modify/import/export/save operations via input_params, config_options, and output_format even though its stated purpose is read-only blockchain data querying. In combination with write and exec tool access, these vague capabilities can justify unintended file writes, imports, or other state-changing actions beyond the minimum needed for the task.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The result-handling section advertises export/save/convert operations without clearly warning that these may write data to disk or otherwise persist user/query results. In a skill that includes the write tool, undocumented persistence is dangerous because users may expect read-only behavior while the agent creates files or exports sensitive query outputs.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger condition says to use the skill for general data analysis, report generation, statistical insights, and visualization, which is much broader than blockchain query routing. Overbroad activation criteria increase the chance the agent invokes this skill in unrelated contexts, where its exec/write-enabled workflow could perform actions the user did not intend.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill markets itself as a free read-only blockchain query tool, but its error-handling section instructs the agent to execute generic network diagnostic commands such as ping. That expands behavior from passive data retrieval into arbitrary host-level command execution, which is risky in a skill with the exec capability and creates an unnecessary path for misuse or policy bypass.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill's natural-language instructions and descriptions are presented entirely in Chinese, with no indication that users may choose another language or that the skill is intentionally region-specific. This can violate a language/locale policy when a specific language is effectively required without user opt-in.

Content

No source excerpt is available for this finding.