T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/api-client.js:68- Finding
Direct-IP Mode Disables TLS Certificate Verification
- Content
View full analysis
- Remediation
View remediation
Security audit
Defillama Data Aggregator
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent DefiLlama data-query CLI, but users should be aware of insecure optional network configuration and CSV/terminal output hardening gaps.
Install only if you are comfortable with an npm-based CLI that contacts DefiLlama public APIs. Avoid enabling any direct-IP HTTPS configuration, treat CSV exports as untrusted before opening them in spreadsheets, and prefer a lockfile or reviewed pinned dependencies for production use.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Note
- Location
src/utils/formatter.js:96- Finding
API-Controlled Terminal Escape Sequences Are Printed Without Sanitization
- Content
View full analysis
30 ? `${value.substring(0, 27)}...` : value; } ``` ### Technical Analysis String values obtained from external APIs are returned directly to the table formatter. Length truncation does not remove ASCII control characters, ANSI escape sequences, carriage returns, or other terminal control codes. If an upstream response contains a malicious protocol, pool, chain, project, or symbol value, displaying the response in table format can cause the user's terminal to interpret those bytes rather than render them as inert text. Normal exploitation requires control over an upstream response, such as compromise of the API, interception through an insecure transport configuration, or another mechanism capable of modifying returned data. ### Attack Path 1. An attacker gains the ability to influence a field in a DefiLlama API response. 2. The attacker inserts terminal control characters into a textual field. 3. The user runs a command with table output, such as a protocol or yield-pool query. 4. `formatCell()` passes the malicious string to `cli-table3` without removing control characters. 5. The resulting table is printed to the terminal. 6. The terminal interprets the embedded sequence, potentially altering displayed content, creating deceptive output, changing terminal state, or invoking terminal-specific features. ### Impact Assessment The attacker may spoof or conceal terminal output and misrepresent financial data. Depending on terminal capabilities and configuration, crafted sequences may also manipulate window titles, hyperlinks, or clipboard contents. This issue does not inherently provide system privileges or arbitrary code execution. Its direct scope is the active terminal session and the user's ...[truncated 40 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
src/utils/formatter.js:127- Finding
CSV Export Does Not Neutralize Spreadsheet Formulas
- Content
View full analysis
{ if (value === null || value === undefined) return ''; const str = String(value); if (str.includes(',') || str.includes('"') || str.includes('\n')) { return `"${str.replace(/"/g, '""')}"`; } return str; }; const header = keys.join(','); const rows = items.map(item => keys.map(key => escapeCsv(item[key])).join(',') ); ``` ### Technical Analysis The CSV formatter correctly escapes delimiters, quotation marks, and line breaks, but it does not neutralize spreadsheet formula prefixes. Values beginning with `=`, `+`, `-`, or `@` may be interpreted as formulas when the exported file is opened in spreadsheet software. CSV quotation does not reliably prevent formula evaluation. Because protocol and yield data originate from external API responses, an attacker who controls or alters an upstream field can place a spreadsheet formula in the generated CSV. ### Attack Path 1. An attacker controls or modifies a textual field returned by an upstream API. 2. The field is set to a formula-like value beginning with `=`, `+`, `-`, or `@`. 3. A user exports results using `--format csv` and saves the output to a file. 4. `escapeCsv()` performs ordinary CSV escaping but leaves the formula prefix intact. 5. The user opens the generated file in spreadsheet software. 6. The spreadsheet interprets the attacker-controlled cell as a formula. 7. Depending on the spreadsheet product and its security settings, the formula can trigger external requests, disclose spreadsheet data, present deceptive links, or invoke other formula-supported functionality. ### Impact Assessment Successful exploitation may disclose data accessible to the spreadsheet, cause outbound network requests, mislead the user, or trigger application-specific functionality. The practical effect depends o ...[truncated 252 chars]- Remediation
View remediation
{ if (value === null || value === undefined) return ''; let str = String(value).replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, ''); if (/^[\s]*[=+\-@]/.test(str)) { str = `'${str}`; } return `"${str.replace(/"/g, '""')}"`; }; ``` - Add regression tests for formula prefixes, leading whitespace, tabs, embedded quotes, commas, and multiline values. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (19)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The documented behavior materially mismatches the detected capabilities and claimed features: the skill appears to access additional data classes not disclosed, while some advertised features are not actually implemented. This is dangerous because reviewers and users may make trust decisions based on inaccurate documentation, allowing unexpected network access or hidden functionality to pass under a benign description.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code silently disables HTTPS certificate verification for IP-direct requests without any warning, confirmation, or guardrail. This makes insecure transport easy to enable accidentally and exposes API responses to tampering or interception, which is especially risky in a data aggregation component that may feed trading, monitoring, or reporting workflows.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill declares installation and runtime behavior that require network access and potentially environment interaction, but it does not declare an explicit tool scope such as permissions or allowed-tools. This weakens sandboxing and reviewability because consumers cannot tell from the manifest what capabilities the skill expects, increasing the chance of overbroad execution in hosts that rely on metadata for policy enforcement.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md | Endpoint | Description | |----------|-------------| | `https://api.llama.fi/tvl` | Total DeFi TVL | | `https://api.llama.fi/protocols` | All protocols | | `https://api.llama.fi/protocol/{name}` | Protocol details | | `https://api.llama.fi/chains` | All chains |
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md | Endpoint | Description | |----------|-------------| | `https://api.llama.fi/tvl` | Total DeFi TVL | | `https://api.llama.fi/protocols` | All protocols | | `https://api.llama.fi/protocol/{name}` | Protocol details | | `https://api.llama.fi/chains` | All chains |
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md | Endpoint | Description | |----------|-------------| | `https://api.llama.fi/tvl` | Total DeFi TVL | | `https://api.llama.fi/protocols` | All protocols | | `https://api.llama.fi/protocol/{name}` | Protocol details | | `https://api.llama.fi/chains` | All chains |
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md | Endpoint | Description | |----------|-------------| | `https://api.llama.fi/tvl` | Total DeFi TVL | | `https://api.llama.fi/protocols` | All protocols | | `https://api.llama.fi/protocol/{name}` | Protocol details | | `https://api.llama.fi/chains` | All chains |
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
In IP-direct mode, the client creates an HTTPS agent with rejectUnauthorized set to false, which disables TLS certificate validation and allows man-in-the-middle interception or spoofed upstream responses. For a DeFi data aggregation skill, upstream integrity matters because manipulated protocol, TVL, or yield data could mislead downstream decisions, and direct-IP access is not justified enough to offset this risk.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The dependency uses a caret range instead of an exact version, which makes builds non-reproducible and can silently pull in newly published releases. In a CLI/data-aggregator skill that depends on external packages, this increases supply-chain risk because a compromised or vulnerable upstream minor/patch release could be installed without review.
- Content
json "author": "AntalphaAI", "license": "MIT", "dependencies": { "axios": "^1.6.0", "chalk": "^4.1.2", "cli-table3": "^0.6.3", "commander": "^11.1.0",
Unverifiable Dependency: axios has 16 known advisory(ies) (CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 89% confidence
- Finding
Axios has multiple known advisories, and because the manifest uses an unpinned range, it is impossible to verify from this file whether the installed version is affected. In a DeFi data aggregator that likely makes outbound HTTP requests, axios is a high-value dependency: unresolved SSRF, MITM, or prototype-pollution-related flaws could directly affect fetched data integrity and request handling.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
The chalk dependency is specified with a caret range, allowing automatic adoption of later compatible releases. This is more concerning here because static analysis also notes a malicious-package advisory associated with chalk, so leaving the version unpinned materially increases exposure to supply-chain compromise.
- Content
json "license": "MIT", "dependencies": { "axios": "^1.6.0", "chalk": "^4.1.2", "cli-table3": "^0.6.3", "commander": "^11.1.0", "node-cache": "^5.1.2"
Unverifiable Dependency: chalk has 1 known advisory(ies) (MAL-2025-46969 (Malicious code in chalk (npm))), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 88% confidence
- Finding
The manifest does not pin chalk, so it is not possible to determine whether installations resolve to a release impacted by the cited malicious-package advisory. Even though chalk is primarily cosmetic, a malicious dependency can execute during installation or runtime and compromise the host environment, making this a meaningful supply-chain concern.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
Using a version range for cli-table3 permits non-deterministic dependency resolution across environments. While not an immediate exploit by itself, it increases the attack surface for supply-chain issues and makes it harder to verify exactly what code is being executed.
- Content
json "dependencies": { "axios": "^1.6.0", "chalk": "^4.1.2", "cli-table3": "^0.6.3", "commander": "^11.1.0", "node-cache": "^5.1.2" },
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
The commander package is not pinned to an exact release, so future installs may resolve to different code than originally tested. For a CLI entrypoint package, argument-parsing libraries are security-relevant because compromise or regression there can affect all command execution paths.
- Content
json "axios": "^1.6.0", "chalk": "^4.1.2", "cli-table3": "^0.6.3", "commander": "^11.1.0", "node-cache": "^5.1.2" }, "engines": {
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
The node-cache dependency is declared with a caret range, allowing upstream patch/minor updates to be pulled automatically. This weakens build integrity and may introduce vulnerable or malicious code without any corresponding repository change.
- Content
json "chalk": "^4.1.2", "cli-table3": "^0.6.3", "commander": "^11.1.0", "node-cache": "^5.1.2" }, "engines": { "node": ">=16.0.0"
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The manifest describes a DefiLlama data aggregator with output formatting, health monitoring, and security validation. In addition to those functions, the code loads local config files and later checks process.env.DEBUG to alter behavior, which are host-environment access capabilities not clearly justified by the stated purpose in this file.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This code performs network calls to third-party DefiLlama services, but there is no confirmation prompt, user-facing log, or warning in the file indicating that user-supplied query values may be sent externally. For a code file, outbound network transmission is a safety-relevant operation when it lacks any visible disclosure.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The getPoolYields method sends a request to a different third-party host, https://yields.llama.fi/pools, yet this file contains no user-facing warning or notice about the outbound call. This fits the missing-warning criterion for code files because network transmission occurs without visible disclosure.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The constructor exposes a rejectUnauthorized configuration, but the IP-direct HTTPS path ignores it and always sets rejectUnauthorized to false. This creates a security-control bypass and can mislead operators into believing certificate verification is enabled when it is not, increasing the likelihood of insecure deployment.
- Content