The skill contains legitimate installation instructions that execute registry packages and a CDN import that loads third-party executable code. Most external-command findings are false positives caused by Markdown backticks and TypeScript examples. No prompt-injection language or evidence of data exfiltration was found in the reviewed files.
4
Files scanned
642
Lines analyzed
11
Review items
0
False positives ignored
Capability review items (9)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The import map loads executable JavaScript from a third-party CDN. This is a supply-chain and availability dependency unless the package URL and version are pinned and trusted.
Most external-command alerts are Markdown backticks, code fences, or TypeScript template literals, not shell execution. The real residual risks are npm/npx package execution, unpinned latest scaffolding, and a third-party CDN import. No prompt injection language was found in the reviewed files.
The skill directs agents to run npx create-near-app@latest and an install variant with --install. This can execute changing npm registry code and install dependencies without pinned versions.
The instructions explicitly use @latest and --install in shell commands. That combination creates clear supply-chain risk, even though the workflow is legitimate.
Quick-start wallet examples set network to mainnet before showing contract calls and transfers. Copying this pattern can place user transactions on mainnet before testnet validation.
The cited examples use mainnet and later present write, transfer, and conversion helpers. The risk depends on user choices, so confidence is high enough to flag but not severe.
Capability review items (5)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The Markdown fence introduces a shell command that runs npx create-near-app@latest. That downloads and executes npm package code from the registry, so user confirmation and version pinning are needed.
The import map loads package code from the third-party esm.sh CDN. This is legitimate documentation, but it creates supply-chain and availability risk if copied without pinning or review.