跨链代币入门工具

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:35 AM UTC
• Version: 1.0.1

Overview

This skill is a token lookup guide, but it asks for command execution and file write authority and tells users to install unpinned Python packages without a reviewed implementation script.

Review before installing. Only use this in an isolated environment, avoid granting filesystem write or broad shell execution unless you intentionally need it, pin and verify Python dependencies, and do not provide API keys beyond the specific blockchain services you intend to query.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:136

Finding

Unpinned Third-Party Dependencies Installed from an Unrestricted Package Source

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 136
Vulnerability Type: Unpinned and unverifiable third-party dependencies
Risk Level: Medium

Vulnerable Code Snippet:

bash

pip install requests web3

The same unpinned installation approach is also documented for the individual dependencies at lines 233–234.

Technical Analysis

The installation command does not specify package versions, hashes, a lock file, or a trusted package index. Consequently, the versions and transitive dependency graph installed by users can change without any corresponding modification to the audited skill.

Python package installation can execute package build or installation logic. If an upstream package, release account, package index, or transitive dependency is compromised, following this instruction may introduce and execute unreviewed code. The absence of version constraints also creates reproducibility and compatibility risks even when no malicious package is involved.

This finding does not establish that requests or web3 is currently malicious. The vulnerability is the skill's inability to constrain or verify the dependency artifacts it instructs users to install.

Attack Path

1. A user or Agent follows the environment preparation instructions.
2. pip queries its configured package index and resolves the latest compatible versions of requests, web3, and their transitive dependencies.
3. An upstream account, release, package-index response, or transitive dependency has been compromised or unexpectedly changed since the skill was reviewed.
4. pip downloads the mutable dependency set without validating it against project-approved hashes.
5. Malicious package installation logic may execute during installation, or malicious library code may execute when the package is imported by a future implementation.

Impact Assessment

A compromised dependency would execute with the privileges of t ...[truncated 496 chars]

Remediation

View remediation

Remediation Suggestions

1. Provide a reviewed dependency manifest with exact versions rather than direct unpinned installation commands.

2. Generate and publish cryptographic hashes for every direct and transitive dependency.

3. Require hash validation, for example:

   bash

   python3 -m pip install --require-hashes -r requirements.txt
   

4. Use a lock-generation workflow such as pip-tools and review dependency updates before regenerating the lock file.

5. Explicitly document the approved package index and prevent unintended fallback to untrusted indexes.

6. Install dependencies in an isolated virtual environment under a non-privileged account.

7. Add automated dependency vulnerability and provenance checks to the release process.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:24

Finding

Skill Declares Command Execution and Filesystem Write Access Beyond Its Documented Needs

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 24–27
Vulnerability Type: Excessive tool permissions and violation of least privilege
Risk Level: Medium

Vulnerable Code Snippet:

yaml

tools:
  - read
  - exec
  - write

Technical Analysis

The skill declares access to arbitrary command execution and filesystem writing, while its stated purpose is to query token metadata, prices, liquidity, and contract information. The package contains only SKILL.md; it contains no local scripts whose operation justifies general-purpose exec or write capabilities.

Granting tools that are not required by the documented read-only query workflow violates the principle of least privilege. If the hosting Agent interprets this metadata as authorization, generated commands, malformed inputs, future content changes, or indirect instruction injection could gain access to command execution and file modification that would otherwise be unavailable.

The declaration alone does not prove that commands or writes are currently performed. The risk arises from unnecessarily expanding the capability boundary available when the skill is loaded or invoked.

Attack Path

1. The skill is installed or loaded by an Agent platform that grants the tools declared in its metadata.
2. The Agent receives read, exec, and write capabilities even though the documented operation is principally a remote, read-only data lookup.
3. An attacker supplies crafted task content, token data, or other untrusted instructions that influence the Agent's next action, or a future revision introduces unsafe execution instructions.
4. The Agent uses the already-authorized exec or write tool instead of remaining within a constrained query interface.
5. Commands execute or files are modified with the privileges of the Agent process.

Impact Assessment

If enforced as an authorization declaration, exec could permit command e ...[truncated 618 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove exec and write from the declared tools unless an implemented and reviewed feature strictly requires them.
2. Prefer a narrowly scoped, read-only HTTP or blockchain-query tool with an allowlist of approved API and RPC destinations.
3. If local execution is essential, ship auditable implementation scripts and authorize only those fixed entry points rather than arbitrary shell execution.
4. Validate token symbols, chain names, addresses, URLs, and all other user-controlled parameters against strict schemas and allowlists.
5. Run any required process in a sandbox with a non-privileged account, restricted network access, and a read-only filesystem except for a dedicated temporary directory.
6. Require explicit user confirmation before executing commands or modifying files.
7. Document why each requested tool is necessary and add tests ensuring the skill cannot access capabilities outside its token-query workflow.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The activation description is overly broad, covering generic data analysis, report generation, statistics, and visualization tasks without clear trigger boundaries. This can cause over-invocation, where an agent selects this skill for unrelated tasks and exposes broader tools or external integrations than the user intended.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill requests exec and write tools even though its stated purpose is read-only token data lookup. Excess tool privileges are dangerous because they allow local command execution and filesystem modification, enabling unintended side effects or abuse if the skill is invoked on adversarial input or misrouted tasks.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill claims to be a free, read-oriented cross-chain token query tool, but the documented interface broadens into create/query/export operations. This mismatch can cause an agent to grant the skill authority or invoke workflows beyond the user's expected read-only scope, increasing the chance of unintended file generation, data exfiltration, or unsafe task expansion.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The capability coverage enumerates a very broad set of keywords and lacks meaningful exclusions, effectively encouraging invocation for loosely related topics. Ambiguous scope is risky because it expands the skill's operational surface and makes it easier for prompt-routing mistakes or adversarial phrasing to trigger higher-privilege behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The documentation advertises additional commands such as token listing and contract verification that are outside the narrower manifest description of token info, price, and liquidity lookup. Capability drift like this is dangerous because agents may rely on the broader instructions and execute unreviewed behaviors not covered by the declared security boundary.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The user-facing name and primary description are in Chinese, while key invocation text includes English phrases like 'Use when'. This presents inconsistent language expectations and does not state whether the user can choose their preferred language for interaction or output.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.