solidity-audit

• Outcome: Review
• Latest audit: Sep 14, 2026 · 9:10 PM UTC
• Version: 1.0.1

Overview

This is a mostly relevant Solidity audit helper, but it includes unsafe install commands and a scaffolding script that can write outside the chosen folder.

Review before installing. Do not run the documented curl-to-bash Foundry installer as written; prefer pinned releases, checksums/signatures, package-manager lockfiles, or an isolated container. Treat the helper script as file-writing code and use simple project names without slashes or dot-dot components until path validation is added.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:521
• Finding: Mutable Remote Foundry Installer Is Piped Directly into a Shell## Vulnerability Details **File Locations**: - `SKILL.md:521-524` - `references/testing-guide.md:9-12` - `references/toolchain-guide.md:49-52` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical **Vulnerable Code**: `SKILL.md:521-524` ```bash # Installation curl -L https://foundry.paradigm.xyz | bash foundryup ``` `references/testing-guide.md:9-12` ```bash # Install Foundry curl -L https://foundry.paradigm.xyz | bash foundryup ``` `references/toolchain-guide.md:49-52` ```bash # Installation curl -L https://foundry.paradigm.xyz | bash foundryup ``` ### Technical Analysis Each instruction retrieves mutable content from an external URL and sends the response directly to `bash`. The user cannot inspect the retrieved installer before execution, and the command provides no version pinning, checksum validation, signature verification, or content allowlisting. The `-L` option follows redirects, which means the final executable response may originate from a different endpoint. HTTPS protects the connection to the responding server but does not protect against compromise of the domain, hosting account, redirect destination, CDN, or release process. It also does not ensure that the installer remains identical to the version reviewed during this audit. Installing Foundry is relevant to the Skill's testing functionality. However, executing mutable remote content directly in a shell is not the minimum privilege or minimum-risk method necessary to install it. ### Attack Path 1. An attacker compromises the installer domain, hosting infrastructure, redirect destination, or content delivery process. 2. The attacker replaces the legitimate response with a malicious shell script. 3. A user follows one of the documented installation procedures. 4. `curl` downloads the attacker-controlled response and follows any configured redirects. 5. `bash` immediately executes the r ...[truncated 771 chars]
• Remediation: ## Remediation Suggestions 1. Remove all instances of `curl ... | bash`. 2. Pin installation instructions to a specific reviewed Foundry release. 3. Download the release artifact separately from the project's documented release repository. 4. Verify a publisher-provided cryptographic signature or checksum before extraction or execution. 5. Display and inspect installer content before running it when a packaged release is unavailable. 6. Perform installation under a non-administrative account and avoid `sudo`. 7. Document the expected downloaded filename, checksum, destination paths, and permissions. 8. Prefer a reproducible container image or other isolated tool environment. 9. Keep all three installation examples synchronized so an unsafe command is not retained in a secondary guide. A safer conceptual workflow is: ```bash # Download a specifically pinned release artifact. curl --fail --proto '=https' --tlsv1.2 \ --output foundry-release.tar.gz \ 'https://trusted-release-location.example/foundry/PINNED_VERSION/foundry-release.tar.gz' # Compare against a separately authenticated, publisher-provided checksum. sha256sum --check foundry-release.tar.gz.sha256 # Extract only after successful verification. tar -xzf foundry-release.tar.gz ``` The actual release URL, version, checksum, and signature process must come from verified upstream release documentation rather than placeholders.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:95
• Finding: Security Tools Are Installed from Mutable, Unpinned Package Versions## Vulnerability Details **File Locations**: - `SKILL.md:95` - `SKILL.md:108` - `references/toolchain-guide.md:14` - `references/toolchain-guide.md:31` - `references/testing-guide.md:69` - `references/testing-guide.md:124` **Vulnerability Type**: Insecure third-party dependency installation **Risk Level**: Medium **Vulnerable Code**: ```bash pip install slither-analyzer cargo install aderyn npm install --save-dev hardhat @nomicfoundation/hardhat-toolbox pip install certora-cli ``` ### Technical Analysis The installation commands resolve mutable package versions from external registries without exact version constraints, lockfiles, or artifact hashes. Consequently, the installed code may differ between executions even when the Skill itself has not changed. Package managers may execute build logic, installation hooks, or package-provided commands. A compromised package release, maintainer account, registry entry, or transitive dependency could therefore introduce attacker-controlled code. The absence of reproducible dependency resolution also makes it difficult to determine which code was used for a particular audit. These dependencies support the declared Solidity audit workflow, so their use is functionally relevant. The issue is that their identity and integrity are not sufficiently constrained. ### Attack Path 1. An attacker compromises an upstream package, maintainer account, or transitive dependency. 2. The attacker publishes a malicious version that satisfies the unconstrained installation request. 3. A user runs one of the documented package-manager commands. 4. The package manager selects and retrieves the malicious version. 5. Malicious code executes during installation, compilation, or subsequent tool invocation. 6. The compromised tool can alter audit output, read accessible project data, or execute additional commands. ### Impact Assessment The immediate privilege level is that of the ...[truncated 491 chars]
• Remediation: ## Remediation Suggestions 1. Pin every direct dependency to a reviewed, exact version. 2. Use ecosystem lockfiles and immutable dependency manifests. 3. Require hashes for Python packages where supported. 4. Commit and verify the Rust and npm lockfiles used by the audit environment. 5. Review transitive dependencies and package installation scripts. 6. Use trusted registries explicitly and reject unexpected registry substitutions. 7. Install each tool in a dedicated virtual environment, container, or restricted user account. 8. Record tool versions and dependency-lock digests in generated audit reports. 9. Update pinned versions through an explicit review process rather than resolving the latest version during each installation. 10. Avoid administrative installation unless a specific component demonstrably requires it. Example hardening patterns include exact version constraints and hash-verified requirements files. The actual versions and hashes should be selected only after reviewing the corresponding upstream releases.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/init_audit.py:81
• Finding: Unsanitized Project Name Can Escape the Selected Output Directory## Vulnerability Details **File Location**: `scripts/init_audit.py:81-114` **Vulnerability Type**: Path traversal through an unvalidated project name **Risk Level**: Medium **Vulnerable Code**: ```python def create_audit_project(project_name: str, output_dir: str = "."): """Create the audit project directory structure.""" base_path = Path(output_dir) / f"audit-{project_name}" if base_path.exists(): print(f"Error: directory {base_path} already exists") return False directories = [ "contracts/src", "analysis/slither", "analysis/aderyn", "analysis/manual", "test/poc", "reports/drafts", "notes" ] for dir_path in directories: (base_path / dir_path).mkdir(parents=True, exist_ok=True) readme_content = README_TEMPLATE.format( project_name=project_name, date=datetime.now().strftime("%Y-%m-%d") ) (base_path / "README.md").write_text(readme_content) findings_content = FINDINGS_TEMPLATE.format( project_name=project_name, date=datetime.now().strftime("%Y-%m-%d") ) (base_path / "findings.json").write_text(findings_content) ``` ### Technical Analysis `project_name` is incorporated directly into a filesystem path without validation. A project name may contain path separators and parent-directory components such as `..`. Prefixing the value with `audit-` does not neutralize traversal components that appear later in the supplied string. The resulting path is not resolved and checked for containment beneath the resolved `output_dir`. Calls to `mkdir(parents=True)` can therefore create directories along an escaped path, after which `README.md` and `findings.json` are written outside the intended audit workspace. The existing-path check reduces some overwrite scenarios because the final destination is rejected if it already exists. It does n ...[truncated 1227 chars]
• Remediation: ## Remediation Suggestions 1. Restrict project names to a conservative identifier format, such as letters, digits, periods, underscores, and hyphens. 2. Reject forward slashes, backslashes, empty names, `.` components, and `..` components. 3. Resolve `output_dir` and the proposed destination to canonical absolute paths. 4. Verify that the resolved destination is a strict descendant of the resolved output directory before creating anything. 5. Fail closed if path resolution or containment validation fails. 6. Use explicit UTF-8 encoding and restrictive permissions where appropriate. 7. Add tests covering absolute paths, both path-separator styles, nested traversal, empty values, symbolic links, and valid boundary cases. Example validation: ```python import re from pathlib import Path PROJECT_NAME_PATTERN = re.compile(r"^[A-Za-z0-9._-]+$") def safe_project_path(project_name: str, output_dir: str) -> Path: if ( not PROJECT_NAME_PATTERN.fullmatch(project_name) or project_name in {".", ".."} ): raise ValueError("Invalid project name") output_root = Path(output_dir).resolve() destination = (output_root / f"audit-{project_name}").resolve() if destination.parent != output_root: raise ValueError("Project path escapes the output directory") return destination ``` If nested project names are intentionally supported, replace the direct-parent condition with a robust descendant containment check and validate every path component independently.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (16)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents the skill as an active smart contract security audit assistant capable of analysis, vulnerability detection, and structured audit execution. However, the supplied code only initializes a filesystem layout for an audit project and creates template files (README and findings.json) containing placeholder content and example commands. It does not inspect Solidity code, invoke Slither/Aderyn/Foundry, parse results, detect vulnerabilities, or generate substantive audit reports. While the scaffolding is related to the audit domain, the primary behavior is project setup, which is materially narrower and different from the declared auditing and detection capabilities.

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match

Content

---
name: solidity-audit
description: >
  Solidity smart contract security audit assistant following EEA EthTrust V3 specification.
  Performs structured audit workflow: vulnerability scanning, security analysis, audit reports.
  Detects reentrancy, integer overflow, access control issues, and more.
  Supports Slither/Aderyn static analysis and Foundry testing.
  Triggers: smart contract audit, solidity audit, security review, vulnerability assessment.
---

# Solidity Smart Contract Audit Assistant

A structured smart contract security audit workflow based on EEA EthTrust Security Levels V3 specification.

## Audit Process Overview

```
1. Project Preparation → 2. Automa

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Instruction Override

High

• Category: Prompt Injection

Content

#### 3.19 Permission Bypass Check
- [ ] Can removeMarket + addMarket bypass time restrictions
- [ ] Does adding/removing sub-modules affect fund safety
- [ ] Does modifying contract addresses bypass security checks

#### 3.20 Timelock Integrity
- [ ] Do all critical parameter changes have timelock

• Confidence: 90% confidence
• Finding: This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Self-Modification

High

• Category: Rogue Agent

Content

#### 3.19 Permission Bypass Check
- [ ] Can removeMarket + addMarket bypass time restrictions
- [ ] Does adding/removing sub-modules affect fund safety
- [ ] Does modifying contract addresses bypass security checks

#### 3.20 Timelock Integrity
- [ ] Do all critical parameter changes have timelock

• Confidence: 90% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# Installation
curl -L https://foundry.paradigm.xyz | bash
foundryup

# Initialize

• Confidence: 97% confidence
• Finding: The skill includes a command that fetches and executes a remote installation script via curl. In an agent or user environment, this creates a direct supply-chain and remote-code-execution risk because the fetched content could change, be compromised, or behave differently across environments.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# Installation
curl -L https://foundry.paradigm.xyz | bash
foundryup

# Initialize

• Confidence: 98% confidence
• Finding: Piping downloaded content directly into bash is a classic command-chaining anti-pattern that eliminates any inspection boundary between retrieval and execution. If an agent were permitted to act on this instruction, it could execute arbitrary attacker-controlled code immediately.

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# Install Foundry
curl -L https://foundry.paradigm.xyz | bash
foundryup

# Initialize project

• Confidence: 98% confidence
• Finding: `curl -L https://foundry.paradigm.xyz | bash` fetches remote content and immediately executes it in the shell, which creates a classic remote code execution and supply-chain risk. If the remote server, transport path, or served script is compromised, a user following the guide could run attacker-controlled commands on their machine.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# Install Foundry
curl -L https://foundry.paradigm.xyz | bash
foundryup

# Initialize project

• Confidence: 99% confidence
• Finding: The `| bash` construct directly chains untrusted network output into a shell interpreter, eliminating any opportunity for review and magnifying the impact of a compromised download source. In a developer-facing security/audit skill, this is especially risky because users may be inclined to trust and execute commands verbatim.

External Script Fetching

High

• Category: Supply Chain

Content

```bash
# Installation
curl -L https://foundry.paradigm.xyz | bash
foundryup

# Compile

• Confidence: 98% confidence
• Finding: The guide instructs users to execute a remotely fetched script directly with `curl ... | bash`, which bypasses integrity verification and executes whatever the remote server returns at that moment. If the hosting domain, transport, or upstream release pipeline is compromised, users of the skill could run attacker-controlled code on their systems.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# Installation
curl -L https://foundry.paradigm.xyz | bash
foundryup

# Compile

• Confidence: 97% confidence
• Finding: The `| bash` construct is the dangerous execution step that turns a network fetch into immediate shell execution, removing any opportunity for review or validation. In a security-audit skill, this is especially risky because users may trust the guide as authoritative and run the command in privileged development environments.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill includes actionable code-like instructions that can lead to file-writing workflows (for example generating reports and test artifacts), but it does not declare an explicit tool scope such as permissions or allowed-tools. In an agent environment, missing tool constraints increases the chance the skill is invoked with broader capabilities than intended, making unintended filesystem modification more likely.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger list includes broad phrases like 'security review' and 'vulnerability assessment' that can match many normal conversations outside Solidity auditing. Overbroad activation can cause this skill to engage in the wrong context, potentially steering an agent into unnecessary security-analysis workflows or tool suggestions.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence
• Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This code file contains user-facing natural-language text entirely in Chinese, including the module description and later CLI messages, without any indication that the skill is region-specific or that another language is available. The policy requires flagging language or locale constraints when they are effectively forced without user opt-in or justification.

Excessive Permissions

Low

• Category: Privilege Escalation

Content

// Check items:
// 1. Is the proxy contract implementation correct?
// 2. Is the initialization function protected against reentry?
// 3. Are upgrade permissions reasonable?
// 4. Is there storage layout conflict?

// Dangerous: Storage layout conflict

• Confidence: 80% confidence
• Finding: Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Vague Triggers

Low

• Confidence: 87% confidence
• Finding: The usage example uses a very general invocation pattern that may reinforce accidental triggering behavior in systems that learn from examples. While not harmful by itself, it increases the chance of the skill being selected for generic 'security' help requests where its commands and guidance may not fit.

Static analysis

No suspicious patterns detected.