Decentralized stop-loss orders for DeFi

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:54 AM UTC
• Version: 1.0.0

Overview

This instruction-only DeFi trading skill is not clearly malicious, but its stop-loss label understates broader live trading capabilities and its signing/relay guidance needs stronger user control.

Install only if you intend to let an agent help prepare and submit live Spot advanced swap orders, not just stop-losses. Before signing or approving, verify chain ID, token addresses, amounts, deadlines, slippage, and that output.recipient is your intended address; treat agents-sink.orbs.network as a third-party relay receiving signed order data.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The README materially conflicts with the skill metadata by presenting a broad advanced-order DeFi protocol rather than a narrowly scoped stop-loss skill. In an agent/integration context, this can cause capability confusion, overbroad trust, or unintended invocation of functions beyond the user's expected scope, especially where hosted endpoints and generalized order execution are implied.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill instructs agents to submit signed orders to an external relay endpoint, but it does not explicitly require informing the user that order contents and metadata will be transmitted off-platform to a third-party service. In a signing and trading context, users may reasonably assume all processing is local or onchain, so undisclosed relay submission creates privacy, consent, and trust risks even if the payload is not directly custodial.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The provided skill manifest says this skill is for decentralized stop-loss orders, but the package metadata identifies it as "spot-skill" and describes support for market, limit, TWAP, take-profit, and delayed-start swaps in addition to stop-loss. That indicates the packaged skill's stated behavior is materially broader than the manifest's narrower stop-loss description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation tells users to copy and modify signed relay payload shapes and to mix fields, but it does not warn that signatures are bound to exact message contents and that signed order payloads are security-sensitive. In a DeFi trading context, this can lead users or downstream agents to mishandle signatures, misunderstand what may be safely edited, or submit malformed or risky orders that could authorize unintended token movements or failed executions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest describes the skill as providing decentralized stop-loss orders, but this examples file documents additional order modes: a Limit Order and a TWAP Order alongside Stop-Loss. Those are distinct trading capabilities rather than obvious implementation details of a stop-loss-only skill, so the documented behavior exceeds the stated scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documentation acknowledges that changing output.recipient is dangerous, but it does not clearly state that doing so can redirect sale proceeds to an attacker-controlled address and cause direct fund loss. In a DeFi stop-loss skill, this omission is more dangerous than in generic software because the parameter controls where assets are delivered after execution, so weak guidance can lead agents or users to construct harmful orders without realizing the consequence.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The quickstart tells users to sign typed data and submit an order, but it does not clearly warn that these actions can create live on-chain or relay-submitted orders that may move assets or consume approvals. In a DeFi trading skill, omission of transaction-risk warnings increases the chance that users treat the flow as harmless setup rather than authorization for real financial activity.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/sign.md (reported line 43)May include surrounding context.

'{order: $typed[0].message, signature: $sig, status: "pending"}' \

./relay-payload.json

curl -fsS -X POST 'https://agents-sink.orbs.network/orders/new'
-H 'content-type: application/json'
--data @./relay-payload.json

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/sign.md (reported line 57)May include surrounding context.

md

status: "pending",
};

const response = await fetch("https://agents-sink.orbs.network/orders/new", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify(relayPayload),

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README advertises additional integrator surfaces and hosted distribution endpoints that go beyond the declared stop-loss purpose of the skill. While not a direct code exploit, this increases attack surface for agent misuse and supply-chain confusion by encouraging consumers to interact with external MCP/hosted resources they may not expect from the manifest alone.

Content

No source excerpt is available for this finding.