yoink

Warn

Audited by Socket on Feb 26, 2026

1 alert found:

Security
SecurityMEDIUM
SKILL.md

This artifact documents legitimate, expected interactions with a public smart contract game. There is no direct evidence of embedded malware or obfuscated code in the provided content. The primary security concern is operational: delegating transaction execution to a third-party (Bankr) or instructing users to paste signing material into external tools can expose private keys or signed payloads. Recommend: verify Bankr's trustworthiness and auth model before using; never paste private keys into third-party UIs or HTTP requests; prefer client-side signing (wallet) with explicit per-transaction approval; log and monitor any delegated signing tokens; and treat any automation that can submit yoink() calls as requiring strict user consent controls.

Confidence: 75%Severity: 75%
Audit Metadata
Analyzed At
Feb 26, 2026, 03:14 AM
Package URL
pkg:socket/skills-sh/BankrBot%2Fskills%2Fyoink%2F@af9c660b7d230c926143e47c59d3548b46a3f88b