The skill contains legitimate documentation and commands for an external blockchain CLI, but several Markdown backtick detections are false positives. Confirmed findings concern execution of CLI commands, wallet private-key handling, and escrow creation that can lock ERC20 tokens on-chain. The workflow should require explicit confirmation before any state-changing or mainnet action.
Irreversible Asset-Locking Transaction Without Confirmation Step
The workflow directs execution of nla escrow:create, which can lock ERC20 tokens on-chain, but it does not require a final user confirmation that shows the network, token, amount, and recipient oracle.
The documented command creates an escrow using user-provided asset and network parameters, and the workflow moves directly from gathering requirements to execution without a final confirmation gate.
Capability review items (11)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The skill explicitly asks users to set PRIVATE_KEY for CLI consumption. A wallet private key is a high-value credential whose exposure permits asset control.
This begins a Bash block that directs the agent to run nla commands. Although the listed checks are low impact, external CLI execution can act on the local environment.
Passing a private key as a command argument creates the same command-line secret exposure risk. The command may also configure a wallet for later transactions.
The skill instructs users to provide a private key through an environment variable for CLI use. This is sensitive credential handling tied to financial transactions.
The audit found many Markdown backtick false positives, but several findings are real because the skill runs the nla CLI and handles wallet private keys. The highest risks are private key exposure and on-chain escrow creation that can lock ERC20 tokens. No prompt injection or malicious exfiltration intent was found in SKILL.md.
On-chain escrow action lacks an explicit final confirmation step
The skill guides execution of nla escrow:create with amount, token, oracle, and arbitration parameters. It should require a final user confirmation before any fund-locking transaction.
The command block directly creates an escrow with financial parameters. The file does not show an explicit final confirmation requirement before execution.
Capability review items (9)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The skill suggests configuring a PRIVATE_KEY environment variable for command execution. Environment variables can leak to subprocesses or logs if handled carelessly.
The fenced block runs nla escrow:create with user-supplied demand, amount, token, oracle, and prompt values. This creates an on-chain escrow and can lock funds.
The line explicitly tells users to set a PRIVATE_KEY environment variable. That is sensitive wallet material and can be exposed if inherited by tools or logged.
The fenced block contains Bash commands that query the local nla installation, network, and wallet. These are expected checks but still execute external local commands.
- Available networks: `anvil` (local), `sepolia`, `base-sepolia`, `mainnet`. Switch with `nla switch
The line instructs users to switch networks with an nla command. It is legitimate CLI guidance but still changes the execution target for later blockchain actions.
- For local dev, `nla dev` starts Anvil, deploys contracts, creates mock tokens, and starts the orac
The line documents nla dev, which starts local services and deploys development contracts. This is expected tooling but it executes external commands with local side effects.