Wayfinder

• Outcome: Review
• Latest audit: May 28, 2026 · 1:01 PM UTC
• Version: 0.0.4

Overview

Wayfinder is a disclosed DeFi automation skill, but it needs Review because it can use local private keys to run live fund-moving trades, transfers, strategies, and scripts.

Install only if you intend to let an agent manage DeFi activity. Use a dedicated low-balance wallet, keep private keys and seed phrases out of chat and logs, pin/review the SDK commit before setup, and require explicit confirmation for every trade, bridge, transfer, approval, withdrawal, strategy action, or custom script.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill clearly instructs the agent to use shell execution, read and write files, access environment variables, and manage local repositories and config files, yet it declares no permissions. That mismatch prevents meaningful sandboxing and user review, especially dangerous here because the same skill can execute live fund-moving DeFi operations and touch wallet/config material stored on disk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: The skill advertises a CLI for DeFi trading and portfolio actions, but also includes repository manipulation, git checkout of arbitrary refs/commits, documentation pulling, source parsing, and metadata rewriting behaviors that are not part of the declared user-facing purpose. Hidden or under-declared repository-state changes expand the attack surface: an agent could alter local code or trust data while the user believes it is only performing trading-related actions.

Context-Inappropriate Capability

Medium

• Confidence: 75% confidence
• Finding: Including CCXT exchange API credential handling extends the skill beyond the stated DeFi/Wayfinder scope into centralized exchange access. That broadening matters because it introduces additional secret types and external trading authority, increasing the blast radius if the skill is misused or if users do not realize CEX keys may be read from config.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: This is a real security weakness in the documentation: the file asserts scripts are sandboxed via `run_script`, but later explicitly recommends a direct `poetry run python .wayfinder_runs/my_script.py` path that bypasses that control. In a DeFi skill that handles wallets, private-key-backed signing, and fund-moving operations, users may rely on the stated sandbox guarantees and execute custom scripts with fewer protections than they expect, increasing the chance of arbitrary code execution, secret exposure, or unintended transactions.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The file includes live trading and bridge execution examples for Polymarket without an adjacent warning that these commands can move real funds, incur fees, and be irreversible once submitted. In a DeFi trading skill, users may copy-paste examples directly, so documentation that normalizes execution commands without explicit risk/confirmation guidance materially increases the chance of accidental loss.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation includes a live execution example using `--force` for a DeFi trading script that can move collateral and open positions, but it does not place a clear warning immediately рядом to the command that real funds may be spent and irreversible on-chain transactions may occur. In a trading skill with wallet access and protocol adapters, this increases the risk of accidental live execution by users or agents who copy examples directly.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation advertises high-risk CCXT methods such as create_order and cancel_order alongside read-only calls without clearly warning that these operations can execute live trades or cancel real orders on centralized exchanges. In a DeFi/CEX trading skill, this increases the chance that an agent or user treats these examples as harmless reference usage and unintentionally causes financial loss, especially because the surrounding content includes direct executable script patterns and real credential configuration.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation includes a live execution command for a HyperLend supply script immediately after a dry-run example, but it does not explicitly warn that using --force will submit real on-chain transactions, move funds, and consume gas. In a DeFi trading skill, this omission is materially risky because users may copy-paste commands and unintentionally commit assets on mainnet-like environments.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The strategy deposit example documents an action that will actively deposit assets and spend gas, but it lacks a clear warning that this is not a read-only status/analyze operation. In the context of an agent skill for automated DeFi strategies, that increases the chance of accidental asset commitment, especially because adjacent commands include non-mutating actions like status and analyze.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This documentation provides copy-pastable commands that execute real trading, transfers, deposits, and withdrawals on a live DeFi venue without an explicit warning that they can move real funds and incur losses, fees, liquidation risk, or irreversible transfers. In a skill designed for automated portfolio and trading operations, omission of a prominent execution-risk warning materially increases the chance of unsafe user action, especially when commands default to production-style behavior.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation gives concrete commands for running live Moonwell lending actions, including a `--force` example, without an adjacent explicit warning that these operations move funds, can change collateral state, and may create liquidation or loss risk. In a DeFi trading skill, omission of transaction-risk warnings increases the chance that a user or downstream agent executes asset-impacting actions as if they were routine or reversible.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The file documents how to perform a live Pendle swap using `--force` and describes `execute_swap` as handling approvals and broadcast, but it does not pair those instructions with an explicit warning that blockchain transactions and token approvals are irreversible and can expose funds. In a DeFi trading skill, this omission increases the chance that an agent or user will execute a real trade from example material without adequate confirmation, especially because approvals may grant spend permissions beyond a single transaction.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The document explicitly instructs users to perform live Polymarket bridge and buy/sell operations and states there is no dry-run mode, but it does not include a direct warning that these actions move real funds and may be irreversible or financially risky. In a DeFi trading skill, omission of such warnings materially increases the chance of accidental execution, especially when users may treat example commands as safe test commands.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The file states that `wallet_label` must resolve to a wallet containing both an address and `private_key_hex`, and labels this as local dev only, but it does not provide a strong secret-handling warning. Documentation that normalizes storing raw private keys in config files without emphasizing secure storage, non-commitment, least exposure, and production avoidance can lead to credential theft and full wallet compromise.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation highlights multiple fund-moving methods such as minting liquidity, burning positions, and swaps, but it does not clearly warn that these actions require transaction signing and can cause irreversible on-chain asset movement. In a DeFi trading skill, this omission increases the risk that users or downstream agents treat these methods like harmless reads and trigger real financial actions without adequate confirmation or risk awareness.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This documentation lists fund-moving Uniswap methods such as adding/removing liquidity and collecting fees, but does not give an explicit warning that these actions can change wallet balances, realize losses, incur gas costs, or be difficult to reverse once signed. In a DeFi trading skill, omission of a clear caution materially increases the chance that an agent or user invokes value-affecting operations without adequate confirmation or understanding of chain, amount units, and execution consequences.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script performs `git checkout` on the SDK repository based on `sdk-version.md` or a user-supplied `--commit` value, which mutates the working tree without confirmation. Even though it attempts to restore the previous ref on exit, this can still disrupt a developer's local SDK state, fail in the presence of uncommitted changes, or leave the repo detached/changed if the script is interrupted or restoration fails.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The manifest description advertises a very broad set of high-risk financial capabilities, including swaps, perps, wallet management, and automated strategy execution, without defining clear activation boundaries or guardrails. In a DeFi skill with network and filesystem access plus explicit execute-style commands, vague scope increases the chance the agent invokes the skill for sensitive actions outside the user's precise intent, potentially leading to unintended trades, transfers, or wallet-affecting operations.

VirusTotal

65/65 vendors flagged this skill as clean.