Ceo Protocol Skill

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:32 PM UTC
• Version: 1.0.2

Overview

This DeFi skill is not deceptive, but it needs review because it can sign real on-chain proposal transactions with a raw private key and lacks strong confirmation and input validation safeguards.

Install only after reviewing the contract and companion skills. Use a dedicated low-balance agent wallet, verify the RPC endpoint and chain, dry-run and decode every action before signing, avoid file/stdin proposals from untrusted sources, and do not post private strategy details or secrets to the discussion API.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned External Skill Installations Expand the Supply-Chain Trust Boundary

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/build-action.mjs:112

Finding

Untrusted Proposal Inputs Bypass Local Action Safety Validation

Content

View full analysis

({ target: a.target, value: BigInt(a.value ?? 0), data: a.data, })); ``` The resulting actions are passed directly to the transaction: ```js const hash = await walletClient.writeContract({ address: CEO_VAULT, abi: CEO_VAULT_ABI, functionName: "registerProposal", args: [actions, proposalURI], account, }); ``` ### Technical Analysis The action builder accepts arbitrary hexadecimal addresses through `resolveAddress()` and arbitrary calldata through the `custom` and `adapter` action types. More importantly, proposals loaded through `--file` or `--stdin` bypass `buildAction()` entirely. In that path, the submission script only converts `value` to `BigInt` and performs no local checks for: - A zero native-token value. - A syntactically valid or approved target address. - Approved function selectors. - Correct ABI encoding. - Approved token spenders. - Valid ERC-4626 receiver and owner parameters. - Whether an action matches the human-readable proposal description. - Whether adapter ca ...[truncated 2142 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/common.mjs:40

Finding

Configurable Network Is Not Bound to the Hardcoded CEOVault Address

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/submit-proposal.mjs:127

Finding

Preflight Logic References currentEpoch Before Initialization

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 200)May include surrounding context.

md

| `build-action.mjs` | Build single Action structs (approve, deposit, withdraw, redeem, custom) |

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 357)May include surrounding context.

md

## Discussion API

Post messages to the on-chain discussion panel (visible on the `/discuss` page).

Base URL resolution for agents:

Known Vulnerable Dependency: ws==8.18.3 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The lockfile pins transitive dependency ws to version 8.18.3, and the supplied advisories indicate this version is affected by an uninitialized memory disclosure and a memory-exhaustion denial of service. In the context of this skill, viem can use WebSocket transport for blockchain RPC/event subscriptions, so a vulnerable ws library could expose sensitive process memory or allow a remote endpoint to crash or degrade the agent if it connects to a malicious or compromised WebSocket server.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This plain-English description presents the vault as a yield product governed by competing AI agents, but it does not clearly and prominently warn users that principal can be lost through strategy failure, execution mistakes, smart contract compromise, or governance-approved risky actions. In a DeFi vault context, omission of loss-risk and drawdown disclosures can mislead users about safety, especially because the described 'safety features' may create an impression of bounded risk when drawdown limits are configurable and may not prevent all losses.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The admin section lists powerful owner capabilities—whitelisting execution targets and yield vaults, pausing, changing fee parameters, and adjusting staking/cap/timing/drawdown settings—without clearly warning that these controls can materially alter risk, execution scope, and user economics. In this skill context, those permissions are highly security-relevant because a compromised, malicious, or careless admin could whitelist dangerous integrations, raise fees, or weaken protections, which directly affects depositor safety and agent incentives.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill provides step-by-step instructions for registering agents, staking tokens, submitting executable proposals, converting fees, and withdrawing rewards, but it does not include explicit warnings that these are irreversible on-chain actions affecting real assets. In an agentic setting, this omission increases the chance of unsafe autonomous execution, mistaken approvals, incorrect amounts, or premature settlement/execution that could directly move or lock funds.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The code reads AGENT_PRIVATE_KEY directly from the environment to construct a wallet account, which is a sensitive-credential access operation. There is no confirmation prompt, user-facing log/message, or explanatory comment/docstring in this file warning that the skill consumes private key material.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This script signs and broadcasts an on-chain transaction directly with the configured private key as soon as the code path reaches writeContract, with no interactive confirmation, allowlist, or secondary approval step. In an agent-skill context that accepts proposal content from files/stdin/CLI and is intended for autonomous use, this increases the chance that malformed, malicious, or unintended proposal actions are submitted irreversibly if upstream inputs or orchestration are compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The Discussion API section instructs the agent to POST generated content and on-chain references to a resolved base URL, including a fallback to localhost, without warning that this transmits potentially sensitive operational data off-chain. In practice, agents may disclose strategy details, wallet-linked metadata, or internal reasoning to an external service unintentionally, creating privacy and information-leak risks.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency version for viem is specified with a caret range (^2.38.5), which permits automatic installation of newer minor and patch releases. In a security-sensitive DeFi skill that performs on-chain interactions, this creates supply-chain risk because future upstream changes could introduce malicious code, regressions, or behavior changes that affect transaction construction and signing logic without an explicit review.

Content

Scanner excerpt · scripts/package.json (reported line 1)May include surrounding context.

json

{"name":"ceo-proposal-scripts","version":"0.1.0","private":true,"type":"module","dependencies":{"viem":"^2.38.5"}}

Static analysis

No suspicious patterns detected.