morpho-market-creation

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:19 AM UTC
• Version: 0.6.0

Overview

This skill is a real Morpho/API3 deployment helper, but it asks users to place a wallet recovery phrase in a local .env file and can broadcast irreversible blockchain transactions with limited safeguards.

Review this carefully before installing. Do not use a production seed phrase or any wallet controlling valuable assets. Prefer Safe, Etherscan with a wallet you control, a hardware wallet, or a dedicated low-value deployment account. Verify chain, contract addresses, oracle feeds, IRM, LLTV, gas cost, and transaction targets before any broadcast, and avoid running dependency installation after secrets are placed in the project.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: package.json:8

Finding

Mandatory Installation of an Unpinned Dependency

Content

View full analysis

Remediation

View remediation

" ``` 2. Generate, review, and commit `pnpm-lock.yaml`. 3. Replace the mandatory installation command with: ```text pnpm install --frozen-lockfile --ignore-scripts ``` 4. If a package genuinely requires a lifecycle script, explicitly allow only that reviewed package rather than allowing installation scripts generally. 5. Do not require package reinstallation on every execution. Install once from a frozen dependency graph and verify package integrity before transaction operations. 6. Keep wallet material outside the project directory and ensure dependency installation occurs before any credential is made available. 7. Consider running dependency installation and transaction-signing operations in separate environments with different privileges. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:160

Finding

Plaintext Wallet Recovery Phrase Stored in the Project Directory

Content

View full analysis

` and `quoteFeed1` to ``, and fill in the remaining fields (decimals, vaults, salt) to match. Also ask them to set `WALLET_MNEMONIC` in the `.env` file. Wait for confirmation. - Ask for approval to run `deploy-oracle.ts`. Wait for an affirmative response, then run: ``` exec command="cd {baseDir} && ts-node {baseDir}/scripts/deploy-oracle.ts " ``` ``` `SKILL.md:181-186`: ```markdown - Ask them to confirm `WALLET_MNEMONIC` is still set in the `.env` file. Wait for confirmation. ### Part 5.2 - Ask for approval to run `create-market.ts`. Wait for an affirmative response, then run: ``` exec command="cd {baseDir} && ts-node {baseDir}/scripts/create-market.ts " ``` ``` `scripts/deploy-oracle.ts:9,55-56,80-81`: ```typescript dotenv.config(); ``` ```typescript if (!process.env.WALLET_MNEMONIC) { console.error('WALLET_MNEMONIC environment variable is required.'); process.exit(1); } ``` ```typescript const provider = initializeStaticProvider(chain.alias); const wallet = ethers.Wallet.fromPhrase(process.env.WALLET_MNEMONIC).connect(provider); ``` `scripts/create-market.ts:9,45-46,62-63`: ```typescript dotenv.config(); ``` ```typescript if (!process.env.WALLET_MNEMONIC) { console.error('WALLET_MNEMONIC environment variable is required.'); process.exit(1); } ``` ```typescript const provider = initializeStaticProvider(chain.alias); const wallet = ethers.Wallet.from ...[truncated 2416 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/create-market.ts:50

Finding

Critical Oracle and Market Parameters Are Not Validated Before Signing

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (21)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says the skill deploys Morpho markets backed by Api3 oracles. The code does not deploy markets at all; it deploys an oracle contract through createMorphoChainlinkOracleV2 on the chainlinkOracleFactory. It also explicitly targets Chainlink-based oracle infrastructure, not Api3. While blockchain deployment behavior is consistent with a deployment-related skill, the primary purpose and oracle backend are materially different from the declared description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

There is a clear description-behavior mismatch. The declared purpose claims deployment of Morpho markets using Api3 oracles, which would imply contract deployment or market configuration behavior. The actual code only reads a static/listed set of Api3-supported chains from a library and logs them. This is a materially different primary purpose and lacks any deployment, Morpho integration, or oracle-backing setup logic.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description says the skill deploys Morpho markets using Api3 oracles, which implies on-chain deployment or configuration logic related to Morpho and oracle-backed markets. The provided code does not perform any deployment, market creation, contract interaction, or Morpho-related actions. It simply reads the Api3 dAPI list, filters active entries, and logs their names. This is a materially different primary purpose, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description says the skill deploys Morpho markets backed by Api3 oracles. The provided code does not deploy anything and contains no market creation logic. Instead, it is a read/lookup utility that resolves a chain alias and prints a block explorer link to the Morpho ChainlinkOracleV2Factory contract. This is materially different in both primary purpose and oracle type: the code references Chainlink, not Api3, and serves as a helper script rather than a deployment implementation.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The description claims the skill deploys Morpho markets backed by Api3 oracles, but the actual code only connects to an Api3ReaderProxyV1 contract via JSON-RPC, calls read(), and logs the oracle value and timestamp. There is no deployment logic, no Morpho integration, and no market creation behavior. This is a clear purpose mismatch rather than a minor implementation detail.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md

---

# Rules
- **NEVER** read .env files or ask for secrets such as WALLET_MNEMONIC.
- **NEVER** read, list, or search inside `node_modules/`, `pnpm-lock.yaml`, or `pnpm-workspace.yaml`,they are not needed for this skill nor relevant to the user.
- **ALWAYS** use the `exec` tool to run commands. Never use Bash or shell directly.
- **ALWAYS** run scripts in skill's directory, which is referenced as `{baseDir}` variable and name is given in this file's name field at top. Prefix every command with `cd {baseDir} &&` to ensure it runs from the correct directory.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.

md

- Run `get-oracle-contract-link.ts` to get the correct Etherscan URL:

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill tells the user to place a wallet mnemonic in a .env file despite earlier stating that it should never ask for secrets. Requesting mnemonic-based wallet setup for executable scripts is highly sensitive because compromise of that secret gives full control over the wallet and can lead to immediate asset theft across networks.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script clearly deploys a Morpho Chainlink oracle via createMorphoChainlinkOracleV2, which conflicts with the skill description claiming Api3-backed market deployment. This mismatch is dangerous because operators may grant trust, approvals, or execution rights under false assumptions about the oracle source and risk model, leading to unintended deployment of different infrastructure than advertised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README explicitly lists scripts that deploy oracle contracts and create Morpho markets, but it does not warn users that these are state-changing blockchain actions that can spend funds, create irreversible on-chain state, or target the wrong network if misconfigured. In a deployment-focused skill that relies on a wallet mnemonic from .env, the absence of clear safety warnings and confirmation guidance increases the chance of accidental misuse by operators.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence

Finding

The skill requires access to sensitive environment data via WALLET_MNEMONIC but does not declare an explicit tool or permission scope. In a skill that can execute package installs and transaction scripts, undeclared secret dependency increases the chance of over-broad execution context and weak review of what the skill can access.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

By prohibiting .env access while simultaneously requiring dotenv-backed execution, the skill creates a misleading safety claim around secret handling. In practice this can cause users to trust the workflow more than they should while still enabling scripts that depend on mnemonic-based signing.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

By prohibiting .env access while simultaneously requiring dotenv-backed execution, the skill creates a misleading safety claim around secret handling. In practice this can cause users to trust the workflow more than they should while still enabling scripts that depend on mnemonic-based signing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill guides the user toward setting a wallet mnemonic and running deployment and market-creation scripts, but it does not prominently warn that these are live on-chain transactions with potential irreversible financial consequences. In a blockchain deployment context, insufficient transaction-risk disclosure can lead to accidental loss of funds, unintended deployments, or execution on the wrong chain.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script sends an irreversible on-chain transaction immediately after computing parameters, with no interactive confirmation, dry-run, or explicit summary of the target contract and market parameters. In an agent or automation context, malformed market-params.json, wrong chain selection, or operator error can cause unintended market creation and permanent on-chain side effects.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

The script reads WALLET_MNEMONIC from the environment and constructs a signing wallet to broadcast a transaction. While blockchain deployment requires signing, the manifest only states a functional outcome about deploying Morpho markets backed by Api3 oracles and does not disclose handling sensitive credentials, making this capability broader than the stated intent as presented.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script submits a live deployment transaction immediately after computing the target address, with no interactive confirmation, dry-run-only default, or explicit warning about spending funds and creating immutable on-chain state. In the context of an agent skill, this increases the chance of accidental or automated deployment from malformed parameters or misunderstood intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The instruction defines approval and rejection using only English examples and directs behavior based on those forms, which can force a specific language interaction pattern. There is no indication that users may respond in another language or choose their preferred locale.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

Using the version specifier "latest" for @morpho-org/blue-sdk makes builds non-reproducible and allows future upstream releases to be pulled in without review. In a market-deployment skill that interacts with DeFi protocols, an unexpected SDK change could alter transaction construction, behavior, or dependency trees and introduce supply-chain risk at install or runtime.

Content

Scanner excerpt · package.json (reported line 8)May include surrounding context.

json

"type": "module",
  "dependencies": {
    "@api3/dapi-management": "4.32.0",
    "@morpho-org/blue-sdk": "latest",
    "dotenv": "^17.4.2",
    "ethers": "^6.16.0"
  }

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

The caret range for dotenv permits automatic adoption of newer compatible releases, which weakens build reproducibility and slightly increases supply-chain exposure. Although dotenv is less security-sensitive than protocol SDKs, a compromised or breaking upstream release could still affect secret-loading behavior or the install process.

Content

Scanner excerpt · package.json (reported line 9)May include surrounding context.

json

"dependencies": {
    "@api3/dapi-management": "4.32.0",
    "@morpho-org/blue-sdk": "latest",
    "dotenv": "^17.4.2",
    "ethers": "^6.16.0"
  }
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The caret range for ethers allows newer minor/patch releases to be installed automatically, which can change transaction encoding, provider behavior, or signing flows over time. Because this skill deploys blockchain markets, any unreviewed library update in a core Web3 dependency could cause incorrect transactions or expand supply-chain attack surface.

Content

Scanner excerpt · package.json (reported line 10)May include surrounding context.

json

"@api3/dapi-management": "4.32.0",
    "@morpho-org/blue-sdk": "latest",
    "dotenv": "^17.4.2",
    "ethers": "^6.16.0"
  }
}

Static analysis

No suspicious patterns detected.