skills-store

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly checks and asks to configure TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID and offers to help edit the .env file (i.e., request and write user secrets), which requires the agent to handle and potentially output secret values verbatim, creating an exfiltration risk.

---

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.92). High risk — the set includes a raw install.sh served from an untrusted/unknown GitHub user (direct curl|sh style), a GitHub releases API for that same little‑known account (which may host unsigned binaries), and an internal LarkSuite doc used as the install/auth guide; running unknown shell scripts or release assets from an unfamiliar repo is a common malware/credential‑theft vector.

---

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). High-risk supply-chain and remote-execution patterns: the skill mandates running remote install scripts (curl | sh), auto-installs npm packages without user confirmation, reads local credential files (~/.cargo/bin/.env) and auto-executes fetched SKILL.md instructions — enabling remote code execution, credential harvesting, and post-install backdoors.

---

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). This skill explicitly fetches and executes content from public third-party sources—e.g., the required "curl -sSL https://raw.githubusercontent.com/.../install.sh | sh" installer and the curl to "https://api.github.com/repos/purong-huang-1121/skills-store/releases?per_page=100" in SKILL.md—which the agent is instructed to read/interpret and which directly influence presentation ordering and installation/behavior, so it exposes the agent to untrusted third-party content that could inject instructions.

---

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly runs remote installers and fetches external content at runtime—most critically it mandates executing the installer via "curl -sSL https://raw.githubusercontent.com/purong-huang-1121/skills-store/main/install.sh | sh" (which fetches and executes remote code), and also issues a runtime fetch to "https://api.github.com/repos/purong-huang-1121/skills-store/releases?per_page=100" to control strategy ordering/presentation—both are required runtime dependencies that directly execute or control agent behavior.

---

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly a DeFi execution tool. It includes direct on-chain financial actions: Aave V3 lending (supply/deposit/withdraw), Uniswap swaps ("swap WETH for USDC", "trade tokens on Uniswap"), Morpho/Ethena staking, and multiple automated strategies that "后台自动运行" and "自动买入/卖出" (grid trading, ranking sniper, signal tracker, memepump). It also requires a signing wallet tool (onchainos wallet login) and references executing chain swaps via a DEX aggregator. These are specific crypto wallet/signing and transaction execution capabilities (wallets, swaps, market buy/sell), not generic tooling—so this grants Direct Financial Execution Authority.

---

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.90). Flagged: the prompt instructs the agent to autonomously run remote installers (curl | sh), execute npx installs with --yes, read and edit user config files, and install/run binaries on the host without further confirmation, which causes unattended modifications to the machine's state and poses a high security risk.