ClawHub
Back to skill

Security audit

Wayfinder

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent DeFi trading tool, but it deserves Review because it installs mutable external trading code, stores signing keys locally, and enables live fund-moving commands and scripts with broad local privileges.

Review this carefully before installing. Use only low-balance dedicated wallets, avoid production private keys in config.json, prefer a secret manager or external signer, pin the SDK to a reviewed commit instead of main, avoid curl-piped installers, and require a fresh transaction preview and explicit confirmation for every live trade, bridge, withdrawal, approval, or generated script.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T03 · Remote Payload Retrieval and Execution

Error
Location
references/setup.md:153
Finding

Remote Poetry Installer Is Downloaded and Executed Without Integrity Verification

Content
View full analysis
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Error
Location
references/setup.md:25
Finding

Mutable Upstream SDK Branch Is Installed and Executed

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:562
Finding

Wallet Private Keys and API Credentials Are Stored Together in Plaintext Configuration

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
references/setup.md:52
Finding

API Key Can Be Supplied Through a Process Command-Line Argument

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:528
Finding

Path-Restricted Python Execution Is Incorrectly Described as Sandboxed

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (24)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

This skill describes itself as a DeFi trading tool but also references local dependency discovery, SDK source parsing, git state manipulation, and even modifying packaging metadata such as skill.json. Those behaviors are materially different from trading/portfolio management and, in context, are more dangerous because the same skill also interfaces with wallets and live execution paths; an attacker or mistake could change local code or metadata and influence later executions.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

This skill describes itself as a DeFi trading tool but also references local dependency discovery, SDK source parsing, git state manipulation, and even modifying packaging metadata such as skill.json. Those behaviors are materially different from trading/portfolio management and, in context, are more dangerous because the same skill also interfaces with wallets and live execution paths; an attacker or mistake could change local code or metadata and influence later executions.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 627)May include surrounding context.

md
**Reference**: [references/adapters.md](references/adapters.md)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 854)May include surrounding context.

md
**Reference**: [references/adapters.md](references/adapters.md)

Self-Modification

High
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · scripts/sync-skill-json-from-sdk.py (reported line 12)May include surrounding context.

python
- skill.json.resources.static/templates (from mcp.resource(...) URIs)
- skill.json.sdk_version (from wayfinder/sdk-version.md)

It does NOT attempt to rewrite SKILL.md or reference docs.
"""

from __future__ import annotations

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill clearly instructs the agent to use shell, read environment variables, and read/write local files, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization gap where a host may expose broader capabilities than users or reviewers expect, which is especially risky for a DeFi skill that can access wallets, config files, and execute live fund-moving commands.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The document broadly describes many adapters with capabilities such as transfers, swaps, borrowing, withdrawals, order execution, and collateral changes, but it lacks a top-level safety warning that these actions can materially change balances, open positions, or create liquidation risk. Because this skill is specifically for DeFi portfolio management and trading across multiple protocols and chains, omission of a general warning increases the chance of accidental high-impact financial actions by users or downstream agents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The Polymarket section includes live bridge_deposit and buy execution examples but does not place an explicit warning immediately рядом that these commands move real funds and may be irreversible. In a DeFi trading skill, executable examples are especially risky because users may copy-paste them directly, leading to unintended deposits or trades if they do not recognize the examples as live operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The documentation shows how to configure API credentials and execute real exchange actions such as create_order without any explicit warning about secret handling, account permissions, or the financial consequences of live trading. In a DeFi/CEX trading skill, users may copy examples directly into production workflows, increasing the chance of credential exposure, over-privileged API keys, or unintended real-money trades.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file includes concrete commands for placing market and limit orders, closing positions, updating leverage, and canceling orders. While the file documents mechanics and some operational gotchas, it does not provide a direct warning that these commands can execute real trades, incur losses, or materially affect user funds.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The file provides executable withdrawal commands and mentions fees and timing elsewhere, but the withdrawal section itself lacks a clear warning that the action moves real funds to Arbitrum and may be difficult or impossible to reverse if misdirected. For a markdown skill description, this is a user-impacting operation that should be explicitly disclosed where the command is presented.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

The statement that the CLI 'auto-approves if needed' indicates the system may autonomously authorize a builder fee approval transaction without a separate, explicit user consent step at execution time. In a high-risk financial skill, automatic approval of spending/fee permissions can expose users to unintended authorizations, especially if configuration is stale, misunderstood, or manipulated by surrounding orchestration.

Content

Scanner excerpt · references/hyperliquid.md (reported line 289)May include surrounding context.

md
### Builder Fee

Builder attribution uses a fixed wallet `0xaA1D89f333857eD78F8434CC4f896A9293EFE65c`. Fee value `f` is in **tenths of a basis point** (e.g. `30` = 0.030%). Set in `config.json` under `strategy.builder_fee`. The CLI auto-approves if needed.

## Spot Orders

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
87% confidence
Finding

Repeating that builder fee approvals are auto-approved if needed reinforces that the tool may take a write action that changes account permissions without a fresh confirmation boundary. In the context of wallet-connected DeFi trading, autonomous approval behavior increases the chance of unintended authorization and makes prompt-injection or orchestration mistakes more dangerous.

Content

Scanner excerpt · references/hyperliquid.md (reported line 324)May include surrounding context.

md
- **Slippage**: Default slippage is applied to market orders. Override with `--slippage` (as a decimal, e.g., 0.01 = 1%).
- **No guessing**: Do not invent funding rates or prices. Always fetch via adapter and label timestamps.
- **USD sizing ambiguity**: When a user says "$X at Yx leverage", always clarify if $X is notional (position size) or margin (collateral). See the Sizing table above.
- **Builder fee approvals**: Builder fees are opt-in per user/builder pair. Fee value `f` is in **tenths of a basis point** (e.g. `30` = 0.030%). The CLI auto-approves if needed.
- **Funding history**: There is no `HyperliquidAdapter.get_funding_history()` — use `HyperliquidDataClient` or the SDK's `Info.funding_history()` directly.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation presents a live execution command using --force immediately after a dry-run example, but it does not prominently warn that this will broadcast an on-chain transaction and may spend user funds. In a DeFi trading skill, unclear separation between simulation and live execution increases the chance of accidental real trades, especially when users copy-paste examples verbatim.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file states that the adapter requires a signing wallet and private_key_hex without any security warning about secret handling, storage, logging, or exposure risk. In a DeFi automation context, disclosure or misuse of a private key can immediately compromise all assets controlled by that wallet, making this more dangerous than generic credential usage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The documentation presents multiple fund-moving methods as routine adapter calls but does not clearly warn that they can execute irreversible on-chain transactions, consume wallet balances, incur slippage, and expose users to loss from misconfiguration. In a DeFi trading skill, this omission is more dangerous because users may copy scripts directly and treat these methods like safe read-only operations.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/strategies.md (reported line 7)May include surrounding context.

md
All strategies support these actions via `poetry run wayfinder run_strategy`:

### Read-Only Actions (no confirmation needed)

| Action | Description |
|--------|-------------|

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/sync-skill-json-from-sdk.py (reported line 58)May include surrounding context.

python
def _git_current_ref(sdk_root: Path) -> str:
    try:
        out = subprocess.check_output(
            ["git", "-C", str(sdk_root), "symbolic-ref", "-q", "--short", "HEAD"],
            stderr=subprocess.DEVNULL,
            text=True,

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/sync-skill-json-from-sdk.py (reported line 68)May include surrounding context.

python
except subprocess.CalledProcessError:
        pass

    return subprocess.check_output(
        ["git", "-C", str(sdk_root), "rev-parse", "HEAD"],
        text=True,
    ).strip()

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/sync-skill-json-from-sdk.py (reported line 75)May include surrounding context.

python
def _git_checkout(sdk_root: Path, ref: str) -> None:
    subprocess.check_call(["git", "-C", str(sdk_root), "checkout", "--quiet", ref])


def _parse_server_py(server_py: str) -> tuple[list[str], list[str]]:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest exposes high-risk capabilities—execution, wallet management, and both network and filesystem access—yet provides no explicit user-facing warning, consent boundary, or indication that actions may move funds or modify local state. In a DeFi trading skill, this omission is especially dangerous because users may trigger irreversible on-chain transactions, asset transfers, or script execution without clear awareness of operational risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The guide states 'Direct Execution (bypasses sandbox — use sparingly)' but the example still executes a script located in .wayfinder_runs/my_script.py. That contradicts the earlier statement that scripts are sandboxed by directory location, and may mislead users about the actual safety boundary of the example shown.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The text states that the wallet in config.json must include a private_key_hex and labels this as "local dev only," but more importantly the document hard-codes Polygon-specific behavior throughout the skill without presenting it as an optional regional or locale choice. This is a natural-language policy concern only insofar as the skill constrains use to a specific environment/context without offering user choice or documenting opt-in flexibility.

Content

No source excerpt is available for this finding.

External Script Fetching

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The documentation recommends piping a remote script directly into the Python interpreter (curl ... | python3 -), which executes unverified code fetched at runtime. If the upstream server, transport, or install script is compromised, a user following the setup guide could execute arbitrary code on the host system.

Content

Scanner excerpt · references/setup.md (reported line 153)May include surrounding context.

md
- **"Python 3.10 not supported"** — Ensure Python 3.12+ is installed and poetry uses it
- **"Missing config"** — Run `python3 scripts/setup.py` or create `config.json` manually
- **"api_key not set"** — Check `config.json` has `system.api_key`, or set `WAYFINDER_API_KEY` env var. Key format: `wk_...`
- **"poetry not found"** — Install poetry: `curl -sSL https://install.python-poetry.org | python3 -`
- **"just not found"** — Install just: `cargo install just` or `brew install just`
- **Key not working** — Verify at https://strategies.wayfinder.ai, check for typos/whitespace. Key should start with `wk_`. Verify with: `poetry run python -c "from wayfinder_paths.core.clients.WayfinderClient import WayfinderClient; print('API key configured!')"`