eigen-da
Fail
Audited by Snyk on Feb 20, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 1.00). The prompt includes an explicit example passing a private key as a command-line argument (--eigenda.signer-private-key-hex=YOUR_PRIVATE_KEY) and placeholders for RPC credentials, which instructs embedding secrets verbatim in commands and thus creates a high exfiltration risk.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.70). The skill's SKILL.md and scripts/da-api.js show it retrieving arbitrary JSON blobs from the public EigenDA network (via the local proxy /get/ and direct endpoints like disperser-sepolia.eigenda.xyz and https://blobs-sepolia.eigenda.xyz), which are untrusted, user-provided data that the agent is expected to read/parse as part of its workflow and could therefore influence subsequent actions.
Audit Metadata