Security audit

ondo-points-farmer

Security checks for vulnerabilities and agentic risk

Overview

This is a real automated trading bot that is partly disclosed, but it can place many live market orders with account credentials without a dry-run mode or confirmation gate.

Review carefully before installing. Only run this if you intend to let it use an Ondo Perps trading API key to place repeated live market orders and incur fees or losses. Use a dedicated limited-permission key, minimal funds, verify the platform rules on volume farming, and do not treat the estimator command as equivalent to the farmer command.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill documentation describes use of environment variables, networked API access, and file-writing capable scripts, but no explicit permissions or capability declarations are provided. This weakens user awareness and reviewability, making it easier for a user to run an account-impacting automation tool without understanding that it can access secrets and perform external actions.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The stated purpose frames the skill as a research-oriented trading assistant, but the described behavior includes fully automated live trading, randomized volume-farming-like execution, broad order cleanup, and referral promotion. That mismatch is dangerous because users may authorize what looks like an analytics tool while actually granting a bot the ability to place and manage real trades with possible financial, compliance, and account consequences.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The environment variable list advertises an automatic withdrawal threshold despite the skill being presented mainly as a trading and points-tracking assistant. Hidden or underexplained fund-movement functionality increases risk because users may unknowingly enable withdrawals or transfers, which materially changes the trust and safety profile of the tool.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The code includes a hard-coded referral link and explicitly markets points-farming behavior, which is not aligned with the declared research/assistant framing. This is dangerous because it conceals financially motivated behavior and can mislead users into executing live trading activity they did not reasonably expect from the skill metadata.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: This section performs repeated live market orders in a buy/sell flip pattern to farm points, far beyond passive tracking or estimation. In context, the mismatch is dangerous because users expecting an estimator or research helper may instead trigger real trades, fees, losses, account changes, and potentially policy-violating wash-like activity on the exchange.

Context-Inappropriate Capability

Low

Confidence: 90% confidence
Finding: The built-in referral link introduces undisclosed self-promotional behavior unrelated to core execution logic. While not a direct code-execution flaw, it is a trust and transparency issue that can bias the tool toward the author's financial benefit without informed user consent.

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: Describing the tool as beginner-friendly and implying setup is trivial downplays the fact that it executes autonomous live trading using account credentials. That mismatch materially increases the chance of unsafe use by inexperienced users, including unintended financial loss and misuse of privileged API access.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The setup instructions ask users to export API credentials for a live trading tool without an explicit warning about secret handling, account permissions, or potential financial impact. In a DeFi trading context, omission of these warnings is more dangerous because compromised or overprivileged credentials can immediately lead to unauthorized trades or account losses.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The run commands present execution as straightforward but do not clearly warn that launching the scripts will initiate automated live trades, manage positions, and potentially close or cancel orders. In this context, the omission materially increases the chance of accidental execution against real funds, especially for users expecting simulation, estimation, or passive monitoring behavior.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The script is designed to place and cancel live orders on a real trading account without any enforced risk acknowledgment, simulation mode, or final confirmation. In a financial-trading context, that makes accidental or uninformed execution especially dangerous because actions are real, costly, and may be hard or impossible to reverse.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/farmer.py:18

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:32