Security audit

Credex Protocol

Security checks across malware telemetry and agentic risk

Overview

This appears to be a legitimate Credex DeFi skill, but it gives an agent raw wallet-signing power for irreversible financial actions without enough built-in confirmation or safety scoping.

Install only if you are comfortable with an agent-accessible CLI using a raw wallet private key for DeFi transactions. Use a dedicated low-value or testnet wallet, verify the pool contract, RPC URL, and CREDEX_AGENT_URL before running commands, and manually review every borrow, repay, approval, deposit, withdrawal, or bridge operation before execution.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill instructs the agent to use environment secrets (`WALLET_PRIVATE_KEY`) and perform networked blockchain actions, but the manifest does not declare permissions or explicitly scope those capabilities. That creates a transparency and governance gap: an invoking system or user may not realize the skill can access signing material and submit fund-moving transactions.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The README instructs users to export a wallet private key and perform borrowing, repayment, liquidity, and bridging operations without any safety guidance about secret handling, transaction irreversibility, network verification, or fund-loss risk. In a skill explicitly designed for financial blockchain operations, omitting these warnings can lead users to expose sensitive credentials in shell history or use the wrong network/account, causing theft or irreversible loss of funds.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The trigger language is overly broad, including 'any credit/lending task on Arc,' which can cause the skill to auto-activate for a wide range of financial requests. In a skill that can borrow, repay, bridge, deposit, and withdraw funds, overbroad routing materially increases the chance of unintended invocation and unauthorized financial actions.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill documents commands that sign transactions affecting debt positions and transferring funds, but it does not require an explicit warning or confirmation before execution. Because the workflow includes borrowing, repaying, bridging, depositing, and withdrawing with a private key, a user or orchestrator could trigger irreversible financial actions without clear informed consent.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The contract reference documents state-changing functions like deposit, withdraw, borrow, repay, and credit-limit management without clearly warning that they move funds, alter debt positions, or may be irreversible once submitted on-chain. In an agent skill focused on automated credit and lending actions, this omission increases the chance that an LLM-driven agent or user invokes high-impact operations without sufficient confirmation or safety gating.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The bridge example shows direct use of a private key adapter and immediately calls cross-chain transfers, but does not warn that this authorizes real asset movement and exposes highly sensitive key material handling requirements. In the context of an AI-agent skill for borrowing and moving USDC across chains, omission of these warnings can lead to unsafe automation, accidental transfers, or insecure key usage patterns.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The bridge command initiates a real fund-moving operation immediately after parsing CLI arguments, with no confirmation prompt, dry-run, or explicit execution-time warning. In an agent skill context handling lending and cross-chain transfers, this increases the chance that an automated or mis-triggered invocation moves assets irreversibly to an unintended chain.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The deposit flow performs both token approval and pool deposit as soon as the command is invoked, without an execution-time warning or confirmation. Because this skill is designed for agent-triggered credit and liquidity tasks, accidental invocation can grant spending allowance and transfer funds into the pool without meaningful user awareness.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The withdraw command burns LP shares and attempts to redeem funds immediately, with no confirmation prompt or explicit warning. In a financial agent skill, this is dangerous because mistaken or prompt-induced execution can alter portfolio positions and potentially realize unwanted liquidity movements without a final approval step.

Unpinned Dependencies

Low

Category: Supply Chain
Content: "openclaw" ], "dependencies": { "@circle-fin/adapter-viem-v2": "^1.4.0", "@circle-fin/bridge-kit": "^1.5.0", "dotenv": "^17.2.4", "ethers": "^6.16.0"
Confidence: 93% confidence
Finding: "@circle-fin/adapter-viem-v2": "^1.4.0"

Unpinned Dependencies

Low

Category: Supply Chain
Content: ], "dependencies": { "@circle-fin/adapter-viem-v2": "^1.4.0", "@circle-fin/bridge-kit": "^1.5.0", "dotenv": "^17.2.4", "ethers": "^6.16.0" },
Confidence: 93% confidence
Finding: "@circle-fin/bridge-kit": "^1.5.0"

Unpinned Dependencies

Low

Category: Supply Chain
Content: "dependencies": { "@circle-fin/adapter-viem-v2": "^1.4.0", "@circle-fin/bridge-kit": "^1.5.0", "dotenv": "^17.2.4", "ethers": "^6.16.0" }, "devDependencies": {
Confidence: 90% confidence
Finding: "dotenv": "^17.2.4"

Unpinned Dependencies

Low

Category: Supply Chain
Content: "@circle-fin/adapter-viem-v2": "^1.4.0", "@circle-fin/bridge-kit": "^1.5.0", "dotenv": "^17.2.4", "ethers": "^6.16.0" }, "devDependencies": { "tsx": "^4.21.0",
Confidence: 95% confidence
Finding: "ethers": "^6.16.0"

Unpinned Dependencies

Low

Category: Supply Chain
Content: "ethers": "^6.16.0" }, "devDependencies": { "tsx": "^4.21.0", "typescript": "^5.9.3" }, "license": "MIT"
Confidence: 87% confidence
Finding: "tsx": "^4.21.0"

Unpinned Dependencies

Low

Category: Supply Chain
Content: }, "devDependencies": { "tsx": "^4.21.0", "typescript": "^5.9.3" }, "license": "MIT" }
Confidence: 86% confidence
Finding: "typescript": "^5.9.3"

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/client.ts:35