Security audit

Vyper

Security checks for vulnerabilities and agentic risk

Overview

The skill does not show malware behavior, but it is advertised as a Vyper blockchain reference while its commands return generic finance and compliance placeholder material.

Review this skill before installing for Vyper or smart-contract work. It does not appear to steal data or modify the system, but its name, category, and usage guidance are misleading relative to the actual content, so relying on it for blockchain development or audit decisions would be unsafe until the publisher aligns the implementation with the advertised purpose.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is presented as a Vyper blockchain reference tool, but the documented commands and descriptions are generic finance/compliance placeholders rather than Vyper-specific functionality. This mismatch can mislead users or downstream agents into invoking the skill in security-sensitive smart contract contexts while receiving irrelevant or incorrect guidance, increasing the chance of operational or development errors.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest advertises Vyper reference behavior, but the command surface covers broad finance and compliance topics unrelated to the Vyper language. In an agent ecosystem, this kind of semantic mismatch is dangerous because tool selection may rely on metadata, causing agents to trust and use the wrong skill for smart contract work.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The usage guidance explicitly says to use the skill for Vyper work, yet the available commands lead to unrelated finance/reference content. This can cause users or autonomous agents to rely on unsuitable output during blockchain development, audit, or compliance workflows, where inaccurate guidance may propagate into contract design or review decisions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script presents itself as a Vyper blockchain reference tool, but the implemented commands output generic finance, compliance, and business material unrelated to the Vyper smart-contract language. This mismatch can mislead users and downstream agents into trusting incorrect guidance in a security-sensitive blockchain context, increasing the chance of configuration, development, or decision-making errors.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The inline documentation explicitly says the tool is for Vyper in blockchain contexts, yet the command outputs contradict that claim by serving unrelated generic reference content. In the context of an agent skill, this is dangerous because users or automated systems may rely on the declared purpose and consume misleading output as if it were authoritative blockchain guidance.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.