Elytro Smart Account CLI

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:07 AM UTC
• Version: 1.0.2

Overview

This is a coherent Elytro wallet and DeFi skill entry point, but it asks users to install mutable unpinned tooling and remote wallet-related skills that were not included in the reviewed artifact.

Review this carefully before installing. Prefer pinned package versions and an immutable repository commit, inspect the referenced Elytro, DeFi, Uniswap, and payroll sub-skills before enabling them, and run installation in a least-privileged environment without unnecessary wallet files, credentials, or production accounts available.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19

Finding

Unpinned Global Installation of the Elytro CLI

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 19
Vulnerability Type: Unpinned globally installed third-party dependency
Risk Level: Medium

Vulnerable Code Snippet:

markdown

1. **Install the Elytro CLI** – `npm install -g @elytro/cli` (Node ≥ 24). Most workflows reference CLI commands, so have it ready.

Technical Analysis

The documented command installs the latest available version of @elytro/cli globally without pinning a reviewed version or verifying package integrity. The effective package contents can therefore change after this Skill has been audited.

npm packages may execute lifecycle scripts during installation. If the package, publisher account, or release pipeline is compromised, following this instruction could execute attacker-controlled code under the privileges of the user running npm. Global installation also exposes the resulting executable throughout the user's environment, increasing its reach beyond the immediate project.

No evidence establishes that the current package is malicious; the vulnerability is the unsafe, mutable dependency installation procedure.

Attack Path

1. An attacker compromises the npm publisher account, package release pipeline, or another component used to publish @elytro/cli.
2. The attacker publishes a malicious release under the legitimate package name.
3. A user follows SKILL.md and runs npm install -g @elytro/cli.
4. npm resolves the mutable latest release rather than a previously audited version.
5. Malicious lifecycle code can execute during installation, or the globally installed CLI can execute attacker logic when subsequently invoked.
6. The payload operates with the permissions of the user who ran the command.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the invoking user's privileges. Depending on that user's access, the payload could read or modify user-accessible files, ...[truncated 336 chars]

Remediation

View remediation

Remediation Suggestions

• Pin @elytro/cli to a specific, reviewed version rather than installing the mutable latest release.
• Verify the package's provenance, signature, and integrity metadata before installation.
• Prefer a project-local installation with a committed lockfile over global installation.
• Run installation under a least-privileged account and avoid administrator or root execution.
• Disable lifecycle scripts where operationally possible, or audit all lifecycle scripts before allowing them to run.
• Establish a controlled update process in which each new version is reviewed and tested before changing the documented pin.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:42

Finding

Unpinned npx Runner Executes and Installs Mutable Remote Skill Content

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 42–50
Vulnerability Type: Unpinned executable dependency and mutable remote Skill source
Risk Level: Medium

Vulnerable Code Snippet:

markdown

## Installation Cheat Sheet

```bash
# Install the whole pack (skills CLI)
npx skills add Elytro-eth/skills

# Focus on the Elytro wallet skill
npx skills add Elytro-eth/skills --skill elytro

# Uniswap planner only
npx skills add Elytro-eth/skills --skill defi/uniswap

text

### Technical Analysis

These commands invoke `skills` through `npx` without specifying a reviewed package version. If the package is not already available locally, `npx` may retrieve and immediately execute it. This creates an execution path from a mutable third-party package into the local environment.

The repository reference `Elytro-eth/skills` is also not pinned to a commit or immutable release. Consequently, the Skill files installed by these commands may differ from those present when this entry-point file was audited. The advertised sub-skills were not included in the reviewed project, so their instructions and any associated files could not be assessed.

The combination of an unpinned executable installer and an unpinned remote content source creates a supply-chain boundary in which either upstream component can change after review. No evidence establishes that the current npm package or GitHub repository is malicious; the finding concerns the unsafe retrieval and execution model.

### Attack Path

1. An attacker compromises the npm package used by `npx skills`, its publisher, or its release process; alternatively, the attacker compromises the referenced GitHub repository or its maintainer credentials.
2. The attacker publishes a malicious runner release or modifies the repository's default branch to contain hostile Skill instructions or supporting content.
3. A user runs one of the documented `npx skills add Elytro-
...[truncated 1169 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the skills runner to a specific reviewed version, such as an exact package version rather than an implicit latest release.
• Pin Elytro-eth/skills to an immutable commit SHA or cryptographically verified release tag.
• Verify package integrity, repository provenance, release signatures, and expected file hashes before execution or activation.
• Avoid combining remote retrieval with immediate execution. Download dependencies and Skill content first, inspect them, and execute only after approval.
• Vendor the complete reviewed Skill pack when reproducible deployment is required.
• Audit every downloaded sub-skill and associated script before enabling it, especially content involved in wallet or transaction workflows.
• Execute the installer in a sandbox or least-privileged environment with no unnecessary access to credentials, wallet files, or sensitive workspaces.
• Implement an allowlist for approved package versions and repository commit hashes.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

Welcome! The `elytro` CLI prints this URL in `elytro --help` so agents always land on the canonical instructions before touching a wallet. Read this document once, then jump into the sub-skills listed below.

> Raw link surfaced in `elytro --help`: `https://raw.githubusercontent.com/Elytro-eth/skills/main/SKILL.md`

Need to **swap tokens? Install [`defi/uniswap/SKILL.md`](./defi/uniswap/SKILL.md).**  
Need to execute another protocol flow? Install that protocol’s folder (e.g., `defi/pendle/SKILL.md`) alongside [`defi/elytro/SKILL.md`](./defi/elytro/SKILL.md).

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The phrase “do DeFi” is an unusually broad trigger for a wallet-related skill pack that can route into transaction-planning and execution flows. In a financial context, vague activation language increases the chance an agent loads high-impact skills without clear user intent, which can widen the attack surface for unintended wallet operations or prompt-manipulated protocol selection.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.