Mamo

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:47 AM UTC
• Version: 1.0.1

Overview

This appears to be a legitimate DeFi skill, but it asks agents to handle raw wallet keys and perform high-impact blockchain and authentication actions that need clearer disclosure and user control.

Review this carefully before installing. Use only a dedicated wallet with limited funds, confirm every transaction and signature request, and check that the skill clearly documents contract creation, approvals, deposits/withdrawals, remote endpoints, and anything stored under ~/.config/mamo. Do not provide a primary wallet private key unless you fully trust the publisher and the exact code version.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill requires access to environment variables and the network, including a wallet private key and RPC connectivity, but does not declare those capabilities explicitly. That creates a transparency and governance gap: users or hosting platforms may authorize and run the skill without realizing it can access secrets and initiate external communications tied to financial operations.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The documented purpose understates the actual behavior: beyond deposit/withdraw/APY/status, the skill creates on-chain contracts, persists local state under ~/.config/mamo, and reportedly supports backend authentication and external price/API lookups. In a DeFi skill handling private keys and asset movements, undisclosed behaviors materially increase risk because users may expose funds, signatures, local data, or wallet metadata without informed consent.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The CLI tells users that auth is unnecessary while the file contains a full SIWE authentication flow that signs messages and sends them to a remote API. This inconsistency can mislead operators about what data may be transmitted and reduce scrutiny of wallet-signing behavior, especially in a financial tool handling private keys and on-chain actions.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The file implements an on-chain `create` operation that deploys a new strategy contract via `createStrategyForUser`, but the skill description only advertises deposit/withdraw/status capabilities. This mismatch is security-relevant because agents or users may grant trust based on the manifest and then unknowingly authorize a broader state-changing blockchain action with irreversible gas costs and contract creation side effects.

Description-Behavior Mismatch

Low

• Confidence: 81% confidence
• Finding: The command persists strategy metadata locally with `addLocalStrategy`, but this side effect is not described in the manifest. While lower risk than on-chain behavior, undocumented local state can mislead users about what data is stored, create stale or spoofable local records, and influence later operations if the local registry is treated as authoritative.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: Authentication data is persisted under the user's home directory in plaintext JSON, which extends the skill's behavior beyond simple DeFi interaction into local secret storage. If the token grants account access, other local processes, backups, or users on a shared system could recover and misuse it, and the manifest/description does not clearly disclose this persistence.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The reference documents `/create-strategy` as a routine API call while noting only later that strategy creation deploys a per-user proxy contract on Base. In a wallet-connected DeFi skill, omitting an explicit warning about on-chain side effects can mislead downstream agent/tool authors into treating the action like an off-chain account setup, causing users to authorize transactions they do not understand and potentially incur gas costs or create persistent contracts.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The help text instructs users to provide a private key through environment variables without any warning about credential sensitivity or safer alternatives. In a DeFi CLI, normalized handling of raw private keys materially increases the chance of unsafe operator practices, secret leakage through shell history/process inspection, and accidental reuse of high-value wallets.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The authentication flow sends a wallet address, SIWE message, and signature to a remote API without an explicit privacy or trust warning. Although SIWE is not equivalent to exposing a private key, transmitting signed wallet-linked identity data to third-party infrastructure can enable tracking, replay attempts against poorly designed backends, or unintended account linkage.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: Writing authentication data to a local file without clear warning or consent creates a real secret-handling risk. In the context of a DeFi skill, auth material can protect access to financial actions or account data, so silent plaintext persistence increases the chance of unauthorized access from local compromise or accidental leakage.

Known Vulnerable Dependency: vitest==1.6.0 — 2 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed); CVE-2025-24964 (Vitest allows Remote Code Execution when accessing a malicious website while Vit)

Critical

• Category: Supply Chain
• Confidence: 96% confidence
• Finding: vitest==1.6.0

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/mamo.mjs:27