ClawHub
Back to skill

Security audit

Aave V3 position risk

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Aave V3 risk-analysis workflow with optional offline arithmetic and no evidence of hidden execution, credential access, persistence, or exfiltration.

Install only if you want an agent to help analyze Aave V3 positions. Treat its outputs as decision support: verify chain, pool, account, token amounts, allowances, and simulations before signing anything, and never provide private keys or seed phrases.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The description promises an Aave V3-focused utility for health factor checks, borrow sizing, repay/withdraw planning, and eMode/isolation constraints. The code is much narrower and more generic: it accepts precomputed integer inputs and performs offline common-base stress calculations. Its own note states it excludes per-reserve mode changes, liquidity, and protocol permission, which directly conflicts with the claim about eMode and isolation constraints. While the health factor and debt-budget calculations are adjacent to the declared purpose, the Aave-specific and mode-constraint portions are not actually implemented, making this a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/mcp.md (reported line 3)May include surrounding context.

md
# Official Aave V3 MCP procedure

Reviewed 2026-10-08 against [official safe-transactions skill](https://github.com/aave/skills/blob/main/plugins/mcp/skills/safe-transactions/SKILL.md), [confirmation skill](https://github.com/aave/skills/blob/main/plugins/mcp/skills/tx-confirmation/SKILL.md) and [live tool contract documentation](https://aave.com/docs/mcp/tools). Source procedures are linked, not copied.

Discover `get_markets` with `version: v3`, applicable `symbols` and actual `user`; preserve returned `market`, `token`, `chainId`. These selectors are not V4 opaque IDs or recalled Pool addresses. Read summary/reserve before previewing the exact action. Inspect `tools/list` as current argument authority.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · references/mcp.md (reported line 3)May include surrounding context.

md
# Official Aave V3 MCP procedure

Reviewed 2026-10-08 against [official safe-transactions skill](https://github.com/aave/skills/blob/main/plugins/mcp/skills/safe-transactions/SKILL.md), [confirmation skill](https://github.com/aave/skills/blob/main/plugins/mcp/skills/tx-confirmation/SKILL.md) and [live tool contract documentation](https://aave.com/docs/mcp/tools). Source procedures are linked, not copied.

Discover `get_markets` with `version: v3`, applicable `symbols` and actual `user`; preserve returned `market`, `token`, `chainId`. These selectors are not V4 opaque IDs or recalled Pool addresses. Read summary/reserve before previewing the exact action. Inspect `tools/list` as current argument authority.

Static analysis

No suspicious patterns detected.