T08 · Insecure Dependencies
Error
- Location
SKILL.md:68- Finding
Unauditable and Unpinned Dependency Installation
- Content
View full analysis
- Remediation
View remediation
Security audit
节点工作工具
Security checks for vulnerabilities and agentic risk
Overview
This skill should be reviewed carefully because it combines wallet staking, sensitive credentials, and remote worker execution with broad activation text and unaudited install/run commands.
Only install this after confirming you intentionally want to run a reward-earning node, fund or stake a wallet, and execute externally assigned tasks. Use a separate machine or sandbox, avoid broad GitHub tokens, keep wallet credentials outside shared workspaces, and do not run the yarn commands unless the full implementation and lockfiles are available for review.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:82- Finding
Remote Worker Execution with Excessive Credential and Financial Privileges
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest markets this skill as a generic project-management and team-collaboration tool, but the body actually instructs the agent/user to set up a wallet, stake funds, configure RPC access, and run a reward-earning worker node. This deceptive mismatch can cause the skill to be auto-invoked in unrelated contexts, exposing users to financial actions, cryptocurrency/node operations, and credential handling they did not intend.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 89% confidence
- Finding
The skill instructs users to create a .env containing sensitive values such as RPC endpoints, wallet password, API keys, and GitHub tokens, then proceed with setup and execution. In a skill with read/exec/write capabilities, directing credential placement and operational use creates a real risk of secret exposure through logs, file reads, backups, shell history, or downstream commands.
- Content
md yarn install # 配置环境 cp .env.example .env # 填入 RPC_URL、OPERATE_PASSWORD、GEMINI_API_KEY 等 # 运行初始化向导
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest uses broad activation wording tied to common project-management and collaboration use cases, which can cause the skill to match benign requests far outside its true purpose. In context, this is dangerous because the skill has exec/write capability and contains instructions for financial/node operations, so overbroad triggering meaningfully raises misuse risk.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The capability statement claims benign core abilities such as Chinese interaction and workflow support, but the implemented content is operational guidance for node execution, wallet usage, and reward tasks. This discrepancy increases the chance of unsafe invocation and misleads users and routing systems about the true risk profile of the skill.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The '能力覆盖范围' section falsely asserts that the manifest's broad productivity scenarios are covered, while the listed operations are actually wallet, node, and reward-related actions. This broad self-justification appears designed to expand activation scope and mask the true operational and financial nature of the skill.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The text claims support for broad scene keywords without precise trigger boundaries, effectively encouraging activation on loosely related requests. Because the skill can guide or enable command execution and credential use, ambiguous trigger scope increases the chance of unintended exposure to risky operational workflows.
- Content