ens-primary-name
Fail
Audited by Gen Agent Trust Hub on Feb 17, 2026
Risk Level: HIGHCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- COMMAND_EXECUTION (HIGH): The scripts
set-avatar.shandset-primary.share vulnerable to Javascript injection. They usenode -eto execute code where shell variables$ENS_NAMEand$AVATAR_URLare interpolated directly into a string literal without escaping. A malicious payload in these variables could escape the string and execute arbitrary Javascript on the host system. - EXTERNAL_DOWNLOADS (LOW): The skill requires the global installation of
@bankr/cliandviem. Whileviemis a well-known library,@bankr/cliis a third-party dependency from an untrusted source that adds to the attack surface. - DATA_EXFILTRATION (LOW): The script
set-primary.shtransmits theTHIRDWEB_SECRET_KEYenvironment variable toapi.thirdweb.comto perform contract reads, which may expose the key to the API provider.
Recommendations
- AI detected serious security threats
Audit Metadata