Crypto limit orders — gasless, non-custodial

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:58 AM UTC
• Version: 1.0.0

Overview

This is an instruction-only DeFi trading helper, but it should be reviewed because it can help submit and cancel real crypto orders while its stated scope and safety disclosures are too narrow.

Install only if you intend to let an agent prepare Spot/Orbs DeFi orders. Before signing or submitting anything, verify token addresses, chain ID, amount decimals, recipient, approval amount, deadline, nonce, order shape, relay endpoint, and any cancellation digest; treat signed payloads as sensitive and require the agent to show the final transaction or typed data first.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill metadata says it is for 'crypto limit orders', but the README describes a much broader capability set including market swaps, TWAP, stop-loss, take-profit, delayed-start orders, and operational/deployment surfaces. This scope mismatch can mislead an agent or operator into granting the skill more trust or permissions than intended, increasing the risk of unintended financial actions in a high-risk DeFi context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README documents operational utilities such as batching multicalls and sweeping token balances, which materially exceed a narrow 'crypto limit orders' skill description. In an agent setting, understated scope is dangerous because these utilities may enable broader asset movement or administrative actions than a user expects, especially in a financial environment where even non-custodial tools can trigger irreversible transactions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill directs the agent to POST signed orders to a third-party relay endpoint, but it does not explicitly disclose to the user that signed payloads, wallet-linked order details, token pair preferences, amounts, chain selection, and timing metadata are being transmitted off-chain to an external service. In a trading context, this can create privacy, consent, and data-handling risks, especially because signed messages may be sensitive and users may reasonably assume the flow is purely onchain or local from the repeated emphasis on 'non-custodial' and 'decentralized.'

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill manifest describes this skill as handling crypto limit orders, but the package metadata says it is for market, limit, TWAP, stop-loss, take-profit, and delayed-start swaps. That indicates the packaged skill is intended for a substantially broader trading scope than the manifest claims.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The document provides near-ready executable order payloads and explicitly tells users to copy and modify them, but it does not include a strong warning to verify token addresses, recipients, chain IDs, deadlines, and signatures before submission. In a crypto trading context, this omission increases the chance of users replaying malformed or unsafe payloads, causing asset loss, failed execution, or signing/submitting orders to unintended contracts or chains.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest description says the skill is for 'Crypto limit orders', which implies a narrower order type scope. This examples file explicitly documents 'Stop-Loss Order' and 'TWAP Order' payloads, indicating the skill supports additional order strategies not reflected in the manifest description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The cancellation section gives direct onchain execution instructions for cancel(bytes32[] digests) but does not warn that this action is irreversible once confirmed and invalidates the exact signed order digest. In a trading skill, that omission can cause users or downstream agents to cancel live orders unintentionally, leading to loss of trading opportunity and potential financial harm from missed execution.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/sign.md (reported line 43)May include surrounding context.

'{order: $typed[0].message, signature: $sig, status: "pending"}' \

./relay-payload.json

curl -fsS -X POST 'https://agents-sink.orbs.network/orders/new'
-H 'content-type: application/json'
--data @./relay-payload.json

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/sign.md (reported line 57)May include surrounding context.

md

status: "pending",
};

const response = await fetch("https://agents-sink.orbs.network/orders/new", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify(relayPayload),

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The manifest claims execution across '8 EVM chains,' but the README says Spot supports multiple EVM chains and defers to config.json as the canonical source. That wording indicates broader or variable chain support rather than the specific, bounded set claimed in the manifest.

Content

No source excerpt is available for this finding.