jinn-node-free

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:31 AM UTC
• Version: 1.0.1

Overview

This skill is not clearly malicious, but it asks users to run unverified setup commands, store credentials, and send real crypto to a generated wallet without enough safeguards.

Review this carefully before installing. Only use it in an isolated environment, verify the exact repository and dependency versions, do not expose unrelated secrets, and do not send ETH or OLAS to any generated address unless you understand the custody, recovery, withdrawal, and irreversible-transfer risks.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:142

Finding

Remote Poetry Installer Is Downloaded and Executed Without Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 142
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: Critical

Complete Vulnerable Code Snippet:

bash

curl -sSL https://install.python-poetry.org | python3 -

Technical Analysis

The troubleshooting instructions pipe the response from a mutable external URL directly into the local Python interpreter. The downloaded program is not pinned to a specific version, saved for inspection, or checked against a cryptographic signature or trusted checksum.

Although the URL appears to be Poetry's official installation endpoint, this pattern makes the code executed on the user's machine dependent on whatever the remote endpoint returns at execution time. Compromise of the hosting infrastructure, publishing process, DNS resolution, or TLS trust chain could therefore turn the installer into an arbitrary payload after the Skill has already passed review.

Immediate execution also prevents the user from inspecting the effective payload before it runs. Installing Poetry this way is not demonstrated to be necessary for the Skill's declared single-task execution and wallet-balance-query functionality.

Attack Path

1. A user encounters the documented poetry not found condition.
2. The user copies and runs the recommended command.
3. curl retrieves the current response from the external installation endpoint.
4. A compromised endpoint or delivery chain returns attacker-controlled Python code.
5. The shell passes that response directly to python3.
6. The payload executes with the permissions of the invoking user.
7. The payload can inspect or modify files available to that user, including project configuration, .env credentials, API keys, OAuth material, and locally accessible wallet data.

Impact Assessment

Successful exploitation provides arbitrary code execution under the invoking user's account. The reachab ...[truncated 462 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the direct download-to-interpreter pipeline.
2. Prefer Poetry packages supplied by a trusted operating-system package manager or an internally controlled artifact repository.
3. If the upstream installer must be used, pin an explicitly reviewed installer version or immutable artifact.
4. Download the installer as a separate file without executing it:

   bash

   curl --fail --show-error --location --output install-poetry.py \
     https://install.python-poetry.org
   

5. Verify a publisher-provided cryptographic signature or a trusted, version-specific SHA-256 checksum before execution.
6. Inspect the downloaded file and execute it only after successful verification.
7. Run installation with a non-privileged account and restrict access to .env, wallet files, and authentication tokens during installation.
8. Document the exact Poetry version required and explain why Poetry is necessary for the declared functionality.

T08 · Insecure Dependencies

Error

• Location: SKILL.md:87

Finding

Unpinned Package Installation and Transient CLI Execution Create Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 87, 101–102, 145, and 174
Vulnerability Type: Execution of unpinned and unauditable third-party dependencies
Risk Level: High

Complete Vulnerable Code Snippets:

bash

corepack enable && yarn install

bash

corepack enable
yarn install

bash

npx @google/gemini-cli auth login

The npx command is repeated at line 174.

Technical Analysis

The Skill directs users to install project dependencies with Yarn and execute a registry-resolved CLI through npx. The audited project contains only SKILL.md; it does not include the referenced repository URL, package.json, package-manager configuration, lockfile, integrity metadata, or implementation scripts.

Consequently, the dependencies and lifecycle scripts executed by yarn install cannot be reviewed from this package. If the eventual repository lacks an immutable lockfile, dependency resolution may select code that differs from the version originally reviewed. Package installation can also execute lifecycle hooks with the user's permissions.

The npx @google/gemini-cli auth login command does not specify a package version or immutable digest. Depending on the local package-manager state, npx may retrieve and execute the currently resolved registry package. This combines mutable dependency resolution with an authentication workflow that may expose OAuth tokens or related credentials to a compromised package.

The issue is especially consequential because the Skill also handles .env values, a Gemini API key, an operate password, blockchain wallet creation, and funded assets.

Attack Path

1. A user follows the setup or authentication instructions.
2. Yarn or npx contacts the configured package registry and resolves dependencies not defined within the audited Skill package.
3. A compromised release, registry account, dependency, lifecycle script, or subs ...[truncated 1118 chars]

Remediation

View remediation

Remediation Suggestions

1. Include an exact, verifiable repository URL and commit identifier rather than instructing users to clone an unspecified repository.
2. Supply and audit package.json, the package-manager configuration, and an immutable lockfile.
3. Pin the Node.js, Corepack, Yarn, and Gemini CLI versions.
4. Install dependencies using immutable-lockfile enforcement:

   bash

   yarn install --immutable
   

5. Pin the transient CLI to a reviewed version rather than resolving the latest available release:

   bash

   npx @google/gemini-cli@REVIEWED_VERSION auth login
   

6. Verify registry integrity metadata and, where possible, cryptographic provenance or signed release attestations.
7. Audit dependency lifecycle scripts and disable them during installation unless they are explicitly required and reviewed.
8. Run installation and authentication in a restricted environment that does not expose wallet files or unrelated secrets.
9. Separate dependency installation from OAuth authentication and wallet setup so installation-time code cannot access authentication tokens or funded-wallet configuration.
10. Do not instruct users to fund generated wallet addresses until the complete implementation, dependency graph, destination derivation, and transaction authorization flow have been independently reviewed.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (9)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The workflow instructs users to fund a generated wallet with ETH and OLAS and perform staking-related setup, but it lacks prominent risk disclosures about irreversible transfers, address verification, mainnet exposure, volatility, and custody implications. Because real assets are involved, ambiguous or incomplete warnings materially increase the chance of financial loss from mistakes or deception.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

The example tells users to create and populate a .env file with sensitive values including RPC credentials and an OPERATE_PASSWORD. In a skill with read/write/exec tooling, storing secrets in a local plaintext file raises credential exposure risk through accidental commits, workspace leakage, or downstream command output.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

md

yarn install
# ...
# 2. 配置环境变量
cp .env.example .env
# 编辑 .env，填入：
# RPC_URL=https://base-mainnet.g.alchemy.com/v2/YOUR_KEY
# OPERATE_PASSWORD=MySecurePass123

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description is overly broad and does not clearly bound when the skill should or should not be invoked. In an agent environment, vague scope increases the risk of accidental invocation for unrelated tasks, which is more concerning here because the skill exposes exec, write, and operational instructions for wallet-linked workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The input definition uses generic terms like arbitrary input, options, and callback URL without specifying the allowed commands or safety boundaries. That ambiguity can let an agent treat the skill as a general execution wrapper rather than a narrow node-setup skill, broadening attack surface and misuse potential.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The skill instructs users to invoke npx @google/gemini-cli without pinning a version, which makes execution dependent on whatever package version is current at runtime. If the upstream package is compromised or a breaking release is published, users may execute unexpected code during authentication, increasing supply-chain risk in a skill that already requests API credentials and interacts with wallets.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The document states the free edition does not support withdrawal, recovery, or key backup, but later security guidance discusses fund operations and private wallet backup practices as if they are part of normal use. This inconsistency can mislead an agent or user into attempting unsupported sensitive operations, especially in a wallet-bearing skill involving staking and balances.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

This is the same unpinned npx @google/gemini-cli pattern repeated later in the file. In a workflow that handles API keys and blockchain setup, unpinned transient package execution increases the chance of running malicious or altered upstream code.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest frames the skill as a narrowly scoped blockchain worker helper, but later sections advertise broad file processing, API integration, command execution, and information retrieval capabilities unrelated to that scope. Scope inflation is dangerous in agent ecosystems because it can cause over-selection of the skill for unrelated tasks and unnecessarily grant execution paths involving read/write/exec tools.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 84% confidence

Finding

The troubleshooting guidance recommends piping a remote script directly into python3, which executes code fetched at runtime without prior verification. This is a classic supply-chain and man-in-the-middle risk, and it is more concerning in a skill that already encourages command execution and wallet-related setup.

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

md

| 错误场景 | 原因 | 处理方式 |
|---:|---:|---:|
| `yarn not found` | Node.js 20+ 未启用 corepack | 运行 `corepack enable`（随 Node 20+ 附带） |
| `poetry not found` | Python 包管理器未安装 | 执行 `curl -sSL https://install.python-poetry.org \| python3 -` |
| Python 3.12+ 兼容错误 | 使用了不支持的 Python 版本 | 通过 pyenv 安装 3.11：`pyenv install 3.11.9` |
| Setup 卡住无输出 | 等待钱包资金到账 | 向显示的钱包地址发送 ETH 和 OLAS，确认到账后重新运行 `yarn setup` |
| Gemini 认证失败 | API Key 无效或 OAuth 未登录 | 运行 `npx @google/gemini-cli auth login` 完成 OAuth |