ens-primary-name

Fail

Audited by Gen Agent Trust Hub on Feb 17, 2026

Risk Level: HIGHCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • COMMAND_EXECUTION (HIGH): The scripts set-avatar.sh and set-primary.sh are vulnerable to Javascript injection. They use node -e to execute code where shell variables $ENS_NAME and $AVATAR_URL are interpolated directly into a string literal without escaping. A malicious payload in these variables could escape the string and execute arbitrary Javascript on the host system.
  • EXTERNAL_DOWNLOADS (LOW): The skill requires the global installation of @bankr/cli and viem. While viem is a well-known library, @bankr/cli is a third-party dependency from an untrusted source that adds to the attack surface.
  • DATA_EXFILTRATION (LOW): The script set-primary.sh transmits the THIRDWEB_SECRET_KEY environment variable to api.thirdweb.com to perform contract reads, which may expose the key to the API provider.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Feb 17, 2026, 05:13 PM