Security audit

Galleon DeFi Routing

Security checks for vulnerabilities and agentic risk

Overview

This skill is a DeFi routing checklist that emphasizes user authorization, narrow tool use, wallet handoff, and reconciliation rather than granting itself spending or persistence authority.

Install only if you want an agent to help reason about DeFi routes. Treat it as financial workflow guidance, not a trading bot: review every quote, spender, fee, recipient, and payload, keep signing in your own wallet, and do not provide API keys or wallet permissions beyond the specific task.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · references/agent-lifecycles.md (reported line 7)May include surrounding context.
md
## Across quote and preparation [Official Swap API skill](https://github.com/across-protocol/skills/blob/master/skills/swap/SKILL.md) documents `/swap/approval`. Discover route/token support; bind depositor, final recipient, refund address/chain, exact asset addresses and raw units. `exactInput` amount is input; `minOutput` and `exactOutput` use output. Numeric slippage is a fraction, so `0.005` is 0.5%. Set user-approved limits explicitly rather than accepting `auto` or ambiguous estimation defaults. Preserve approval transactions, `swapTx`, amount maxima/minima, fees, quote expiry and request identity. An `appFee` or analytics/integrator field is not an unstated fee mandate. Do not cache an executable quote across state changes. A source simulation field proves only its reported scope.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · references/agent-lifecycles.md (reported line 11)May include surrounding context.
md
Preserve approval transactions, `swapTx`, amount maxima/minima, fees, quote expiry and request identity. An `appFee` or analytics/integrator field is not an unstated fee mandate. Do not cache an executable quote across state changes. A source simulation field proves only its reported scope. [Embedded-action skill](https://github.com/across-protocol/skills/blob/master/skills/embedded-crosschain-actions/SKILL.md) describes ordered destination calls and dynamically populated balances. Resolve ultimate beneficiary, token, contract and spender for every action. Dynamic “full balance” can consume a handler's execution-time balance; use static bounded amounts when the downstream obligation requires an exact amount. Documentation differs on POST amount semantics, so test the selected contract/API version without moving funds before implementation and preserve unresolved semantics as a blocker. ## Across fill and destination action

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · references/agent-lifecycles.md (reported line 15)May include surrounding context.
md
## Across fill and destination action [Tracking skill](https://github.com/across-protocol/skills/blob/master/skills/tracking-transactions/SKILL.md) uses original `depositTxnRef` or origin-chain/deposit-ID combination, not a new quote as recovery. Read current schema and preserve receipt identity. Bounded polling respects indexer cadence; testnet indexing may be incomplete. `filled` requires destination receipt plus actual token/amount/recipient reconciliation. Embedded calls additionally require `actionsSucceeded` and resulting protocol/beneficiary state. A filled bridge can still leave destination action failed and assets in the destination handler; inspect the current official recovery path and rights before an independently authorized withdrawal. Do not issue another bridge to fix that state.

Unrestricted Tool Access

Medium

Category: Excessive Agency
Confidence: 80% confidence
Finding: Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.
Content: Scanner excerpt · references/evaluation.md (reported line 12)May include surrounding context.
md
| CCTP burn succeeded; attestation is complete; destination mint RPC timed out. | Query used nonce, destination receipt and balance before proposing retry. Never burn again. | | 0x quote lists a spender distinct from transaction target Settler. | Validate approval against the returned allowance spender, never approve Settler. | | User asks for cheapest route; one quote omits approval/destination gas and another includes it. | Normalize costs or mark comparison incomplete; do not rank using incomparable output alone. | | Across tools-list includes `swap_with_wallet` without annotations. | Do not enable all tools as read-only; inspect schema and retain a narrow read allowlist. | | Jupiter REST401; trading MCP docs describe optional key. | Explain separate auth contracts; do not assume REST became keyless or enroll in a paid plan. | | CoW order is partially filled; cancellation response is lost. | Reconcile original UID and fills before replacement; size from remaining exposure. | | Funds sit on one chain; the requested opportunity is on another supported chain. | Treat the account as funded: quote a bridge of the sized amount plus destination gas, include its cost and time, and sequence bridge, verify delivery, then trade. |

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/providers.md (reported line 9)May include surrounding context.
md
| --- | --- | --- | | 0x | [0x API skills, 0x Labs](https://0x.org/post/0x-agent-skills), [CLI documentation](https://docs.0x.org/docs/introduction/develop-with-ai/0x-cli), [official skill source](https://github.com/0xProject/0x-ai) | `0x-api` teaches API integration; beta CLI bundles `0x-trade`. Docs MCP supplies documentation. API v2 uses API key and version headers. Select AllowanceHolder or Permit2 deliberately; never approve Settler. CLI JSON envelopes and dry-run support are documented, not exercised here. `--pay` spends non-refundable money on requests, independently of whether a later swap succeeds. | | CoW | [CoW Protocol SDK](https://github.com/cowprotocol/cow-sdk), [SDK documentation](https://cowprotocol-cow-sdk.mintlify.app/) | Official TypeScript trading/orderbook/bridging/conditional-order modules. v7 requires a matching viem or ethers adapter. Posting a signed intent produces an order UID, not a fill. Verify validity, partial fills, cancellation and settlement. A [CoW Skills grant proposal](https://forum.cow.fi/t/grant-application-cow-skills/3402) is evidence of a proposal, not an official production MCP. No official execution MCP was verified. | | 1inch | [1inch Business AI Skills](https://business.1inch.com/portal/documentation/ai-integration/ai-skills), [MCP](https://business.1inch.com/portal/documentation/ai-integration/mcp-server), [tool reference](https://business.1inch.com/portal/documentation/ai-integration/tools-reference) | Official `1inch/1inch-ai` workflows and `https://api.1inch.com/mcp/protocol`. Public docs/examples/Aqua work without credentials; protected APIs require key or OAuth and applicable entitlements. Intent signing needs a subsequent submission; orderbook approval and typed signature are separate. WalletConnect forwards requests to the user's wallet. API MCP access is not permission to spend. | | Uniswap | [Uniswap Labs AI overview](https://developers.uniswap.org/docs/uniswap-ai/overview), [official skills](https://github.com/ ...[truncated 26 chars]

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/providers.md (reported line 11)May include surrounding context.
md
| CoW | [CoW Protocol SDK](https://github.com/cowprotocol/cow-sdk), [SDK documentation](https://cowprotocol-cow-sdk.mintlify.app/) | Official TypeScript trading/orderbook/bridging/conditional-order modules. v7 requires a matching viem or ethers adapter. Posting a signed intent produces an order UID, not a fill. Verify validity, partial fills, cancellation and settlement. A [CoW Skills grant proposal](https://forum.cow.fi/t/grant-application-cow-skills/3402) is evidence of a proposal, not an official production MCP. No official execution MCP was verified. | | 1inch | [1inch Business AI Skills](https://business.1inch.com/portal/documentation/ai-integration/ai-skills), [MCP](https://business.1inch.com/portal/documentation/ai-integration/mcp-server), [tool reference](https://business.1inch.com/portal/documentation/ai-integration/tools-reference) | Official `1inch/1inch-ai` workflows and `https://api.1inch.com/mcp/protocol`. Public docs/examples/Aqua work without credentials; protected APIs require key or OAuth and applicable entitlements. Intent signing needs a subsequent submission; orderbook approval and typed signature are separate. WalletConnect forwards requests to the user's wallet. API MCP access is not permission to spend. | | Uniswap | [Uniswap Labs AI overview](https://developers.uniswap.org/docs/uniswap-ai/overview), [official skills](https://github.com/Uniswap/uniswap-ai) | Reuse swap-integration/planning and official API/SDK guidance. Skills are instructions, not a deployed trading runtime. Verify API access, Universal Router/Permit2 deployment and protocol version. A planner link only opens an interface. Optional traffic attribution does not imply an integrator fee. | | Jupiter | [Jupiter Swap v2](https://developers.jup.ag/docs/swap), [Trading MCP](https://developers.jup.ag/docs/ai/trading-mcp), [Documentation MCP](https://developers.jup.ag/docs/ai/mcp), [official skills](https://developers.jup.ag/docs/ai/skills) | REST `https://api.jup.ag/swap/v2` require ...[truncated 26 chars]

Static analysis

No suspicious patterns detected.