Agentic Lending Evk

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:20 AM UTC
• Version: 0.1.16

Overview

This live DeFi execution skill is purpose-aligned, but it has review-worthy wallet-safety issues around plaintext private keys, unlimited token approvals, and unguarded zero-slippage swaps.

Review carefully before installing or using live mode. Use only throwaway or tightly scoped wallets, avoid putting raw private keys in request files, disable artifact persistence when secrets are present, revoke allowances after tests, and do not run live swaps unless a nonzero minimum output and trusted router are explicitly verified.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/lib/part2-planner.js:1393

Finding

Raw Wallet Private Keys Are Persisted in Plaintext Workflow Artifacts

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/evk_live_borrow_proof.js:166

Finding

Borrow-Proof Executor Grants Unlimited Token Approvals Without Explicit Opt-In

Content

View full analysis

= amount) { log('approval-ok', { label, spender, allowance: allowance.toString(), needed: amount.toString() }); return; } await sendOrPreview({ live, contract: token, fn: 'approve', args: [spender, MaxUint256], label }); } ``` This function is used for router approvals, debt repayment approvals, and collateral-vault deposit approvals. The implementation always approves `MaxUint256` when the current allowance is insufficient, regardless of the exact amount required. This behavior contradicts the declared policy in `SKILL.md:199`: ```markdown - keep approval scope exact unless the operator explicitly opts into `approvalPolicy.mode = "unlimited"` ``` ### Technical Analysis ERC-20 allowances permit the approved spender to call `transferFrom()` against the token holder up to the approved amount. Approving `MaxUint256` creates a practically permanent, unlimited spending capability. No reviewed code checks an `approvalPolicy.mode` value before issuing the unlimited approval. Therefore, merely running the documented live borrow-proof flow can grant substantially greater authority than required for the immediate swap, repayment, or deposit. The live acknowledgement protects against accidental transaction submission in general, but it does not constitute informed consent to unlimited approval. The approval also remains after the intended transaction and can apply to tokens acquired by the wallet later. ### Attack Path 1. The operator configures and explicitly starts a live borrow-proof workflow. 2. The wallet has an insufficient allowance for a configured router or ...[truncated 1059 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/evk_live_borrow_proof.js:181

Finding

Live Swaps Can Execute With Zero Minimum Output

Content

View full analysis

0n) { const wrappedNative = new Contract(swapConfig.tokenIn.address, wrappedNativeAbi, runner); await maybeWrapNative({ live, wrappedNative, amount: wrapNativeAmount, label: `${label}:wrap-native` }); } if (amountIn <= 0n) { log('swap-skip', { label, reason: 'amountIn is zero' }); return; } await ensureApproval({ live, token: tokenIn, owner: walletAddress, spender: swapConfig.routerAddress, amount: amountIn, label: `${label}:approve-router`, }); await sendOrPreview({ live, contract: router, fn: 'exactInputSingle', args: [[ swapConfig.tokenIn.address, swapConfig.tokenOut.address, Number(swapConfig.fee || 0), walletAddress, amountIn, amountOutMinimum, 0, ]], label, }); } ``` ### Technical Analysis When `swapConfig.amountOutMinimum` is ...[truncated 1776 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This mismatch is more concerning because the skill text explicitly normalizes powerful live actions while also mentioning additional side effects such as debt repayment, swaps, and EVC reconfiguration in the bundled executor. If those effects are not prominently declared in the primary purpose and permission model, an operator may authorize what appears to be a lending workflow while unintentionally permitting broader asset-moving or position-altering operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

This mismatch is more concerning because the skill text explicitly normalizes powerful live actions while also mentioning additional side effects such as debt repayment, swaps, and EVC reconfiguration in the bundled executor. If those effects are not prominently declared in the primary purpose and permission model, an operator may authorize what appears to be a lending workflow while unintentionally permitting broader asset-moving or position-altering operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

This mismatch is more concerning because the skill text explicitly normalizes powerful live actions while also mentioning additional side effects such as debt repayment, swaps, and EVC reconfiguration in the bundled executor. If those effects are not prominently declared in the primary purpose and permission model, an operator may authorize what appears to be a lending workflow while unintentionally permitting broader asset-moving or position-altering operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

This mismatch is more concerning because the skill text explicitly normalizes powerful live actions while also mentioning additional side effects such as debt repayment, swaps, and EVC reconfiguration in the bundled executor. If those effects are not prominently declared in the primary purpose and permission model, an operator may authorize what appears to be a lending workflow while unintentionally permitting broader asset-moving or position-altering operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

This mismatch is more concerning because the skill text explicitly normalizes powerful live actions while also mentioning additional side effects such as debt repayment, swaps, and EVC reconfiguration in the bundled executor. If those effects are not prominently declared in the primary purpose and permission model, an operator may authorize what appears to be a lending workflow while unintentionally permitting broader asset-moving or position-altering operations.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This mismatch is more concerning because the skill text explicitly normalizes powerful live actions while also mentioning additional side effects such as debt repayment, swaps, and EVC reconfiguration in the bundled executor. If those effects are not prominently declared in the primary purpose and permission model, an operator may authorize what appears to be a lending workflow while unintentionally permitting broader asset-moving or position-altering operations.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

md

6. Use the bundled executor at `scripts/evk_live_borrow_proof.js`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.

md

6. Use the bundled executor at `scripts/evk_live_borrow_proof.js`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.

md

6. Use the bundled executor at `scripts/evk_live_borrow_proof.js`

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

md

6. Use the bundled executor at `scripts/evk_live_borrow_proof.js`

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Artifact persistence writes the raw request object to disk, and the request schema can contain secrets such as send.privateKey and feedFunding.privateKey. In a signer-backed DeFi workflow, persisting private keys in plaintext artifacts creates a direct credential exposure path through local disk access, logs, backups, CI artifacts, or later exfiltration by other tools.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill description promises a post-deploy borrowability proof/canary borrow, but the workflow implemented here ends at deployment and handoff verification. In a lending-market deployment context, that gap can cause operators or downstream agents to treat an unproven market as successfully deployable/borrowable, leading to false success claims and unsafe operational decisions on live infrastructure.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill advertises execution-capable behavior involving environment variables, network access, browser-assisted actions, and potential live onchain writes, but it declares no explicit tool scope or permission boundary. In an agent setting, this increases the risk of overbroad tool access and accidental or unauthorized execution, especially because the workflow includes approvals, swaps, deployments, and borrow canaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This reference file explicitly wires a live signer environment variable and an operator acknowledgement placeholder into a workflow whose stated purpose includes real onchain writes, approvals, swaps, feed funding, and borrow execution. In this context, the configuration materially lowers the barrier to accidental asset-moving execution because the file itself provides no embedded warning, safety gating semantics, or human-confirmation context beyond a placeholder string, making misuse or unsafe automation more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This code accesses a sensitive credential via process.env to construct a signing wallet for live transactions. While the usage text mentions that live mode requires the environment variable, it does not clearly warn that the script will read sensitive private-key material from the environment, which is a safety-relevant operation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This helper builds a request object preconfigured for live onchain execution: broadcast.enabled: true, send.enabled: true, dryRun: false, and a runtime-injected private key field. Even though the key and RPC URL are placeholders, the function normalizes unsafe defaults for transaction submission, which is dangerous in an agentic lending skill because downstream components may execute the returned payload without a strong, user-visible consent gate, leading to unintended approvals, deployments, funding, swaps, or borrows.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The planner advertises itself as EVK-first and the skill metadata says not to use it for Morpho, yet the code still accepts 'morpho' in SUPPORTED_PROTOCOLS and validates Morpho requests in multiple entry points. That mismatch expands the tool's reachable surface and can let callers route unsupported protocol inputs through logic not designed for them, creating incorrect plans or unsafe automation decisions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The write site persists full request data without an immediate warning, and those requests may include live private keys and RPC details. In this skill context, which can perform real onchain writes, silent persistence of such secrets materially raises the chance of accidental credential leakage and unauthorized transaction signing.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The manifest focuses on resolving oracle routes, funding feeds, preparing Euler oracle paths, deploying EVK markets, and proving borrowability. This file adds an OffchainRegistry publication step and builds an offchain-publication transaction payload for market manifests, which is ancillary coordination behavior not explicitly covered by the stated purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This code performs irreversible on-chain transaction submission when dryRun is false. While the file enforces an acknowledgement token and accumulates warnings elsewhere, the actual execution path has no confirmation prompt or visible user-facing log immediately before sending transactions.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The package uses caret ranges for security-sensitive runtime dependencies, which allows newer minor/patch releases to be installed without explicit review. In a skill that can perform live onchain actions such as approvals, swaps, feed funding, deployment, and borrowing, a compromised or breaking upstream release could alter transaction construction or execution behavior and materially increase supply-chain risk.

Content

Scanner excerpt · package.json (reported line 27)May include surrounding context.

json

"check": "node --check scripts/bin/agentic-lending-evk.js && node --check scripts/bin/api3-feed-manager.js && node --check scripts/bin/part2-planner.js && node --check scripts/evk_live_borrow_proof.js && node --check scripts/lib/api3-feed-manager.js && node --check scripts/lib/part2-chain-bootstrap.js && node --check scripts/lib/part2-planner.js && node --check scripts/lib/part2-recipes.js"
  },
  "dependencies": {
    "@api3/contracts": "^37.0.0",
    "@api3/dapi-management": "^4.15.0",
    "ethers": "^6.15.0"
  }

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency is not strictly pinned and may resolve to different package contents over time, creating a supply-chain exposure. Because this skill is specifically designed for agentic lending workflows involving oracle/feed management and potential live signer-backed execution, an unexpected upstream change could influence high-value blockchain operations.

Content

Scanner excerpt · package.json (reported line 28)May include surrounding context.

json

},
  "dependencies": {
    "@api3/contracts": "^37.0.0",
    "@api3/dapi-management": "^4.15.0",
    "ethers": "^6.15.0"
  }
}

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

Using a caret range for ethers permits automatic uptake of later compatible releases, which can still introduce behavioral changes, bugs, or a malicious supply-chain event. Given that ethers is the core transaction/signing library for blockchain interactions, any compromised or incompatible update could directly affect wallet operations, approvals, deployments, or borrow transactions executed by the skill.

Content

Scanner excerpt · package.json (reported line 29)May include surrounding context.

json

"dependencies": {
    "@api3/contracts": "^37.0.0",
    "@api3/dapi-management": "^4.15.0",
    "ethers": "^6.15.0"
  }
}

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/lib/api3-feed-manager.js:3393

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/lib/part2-planner.js:1691