T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/evk_live_borrow_proof.js:127- Finding
Live swaps permit arbitrarily weak minimum-output protection
- Content
View full analysis
- Remediation
View remediation
Security audit
Evk Live Borrow Proof
Security checks for vulnerabilities and agentic risk
Overview
This skill is openly designed for live blockchain borrow canaries, but its bundled executor can make irreversible financial changes with incomplete safety enforcement.
Install only if you understand EVK/EVC operations and will run preview first with tiny amounts. Treat live mode as capable of spending gas, approving tokens, swapping assets, repaying debt, depositing collateral, changing collateral/controller settings, and borrowing. Review the config carefully, use exact approvals, set realistic swap minimums from a fresh quote, avoid full-balance deposits unless intended, and be prepared to recover manually from a partially completed sequence.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/evk_live_borrow_proof.js:431- Finding
Prerequisite validation fails open after irreversible live transactions
- Content
View full analysis
- Remediation
View remediation
= borrowAmount` and sufficient account borrow capacity before proceeding. 4. Verify that the borrow vault can price the collateral-vault share token and that the required LTV relationship is configured. 5. Query and validate both enabled collaterals and controllers against an explicitly declared expected final state. 6. Simulate every planned call against current state before sending the first transaction. 7. Where EVK/EVC supports it, submit the operation sequence as an atomic batch so that a failed final borrow reverts all preceding state changes. 8. If atomic batching is unavailable, introduce checkpoints and require renewed operator confirmation before destructive operations such as disabling collateral or controllers. 9. Avoid depositing the full wallet balance by default; require an explicit bounded deposit amount. 10. Provide a documented recovery plan and report all transaction hashes whenever partial execution occurs. ]]>
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 3. Run `node scripts/evk_live_borrow_proof.js --help` for the bundled executor
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 3. Run `node scripts/evk_live_borrow_proof.js --help` for the bundled executor
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill requires access to environment variables, including a live signer environment, but does not declare any explicit tool scope such as permissions or allowed-tools. In an agent framework, this can cause the runtime to grant broader-than-necessary capabilities or make security boundaries unclear, which is especially risky here because the skill is designed to interact with live blockchain state and potentially send transactions.
- Content
Static analysis
No suspicious patterns detected.