ClawHub
Back to skill

Security audit

Gekko

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed DeFi information and recommendation client for a remote API, with no bundled code or local persistence, but its financial guidance should be treated cautiously.

Before installing, treat this as an informational DeFi assistant that sends requests to a third-party API. Do not provide private keys, seed phrases, or unnecessary wallet details, and independently verify any APY, vault, or trading recommendation before moving funds.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)

Missing User Warnings

High
Confidence
94% confidence
Finding
The skill promotes portfolio allocation, yield optimization, and vault recommendations without any visible warning that outputs may influence financial decisions and potentially user funds. In a DeFi context, omission of risk disclosures is more dangerous because users may over-trust APY-driven recommendations despite smart-contract, liquidity, oracle, or depeg risks.

External Transmission

Medium
Category
Data Exfiltration
Content
### Analyze Portfolio
```bash
curl -X POST https://gekkoterminal.ai/api/a2a?agent=gekko \
  -H "Content-Type: application/json" \
  -d '{
    "capability": "portfolio_management",
Confidence
87% confidence
Finding
The skill instructs the agent to send data to an external endpoint controlled outside the local trust boundary. Even though the example appears operationally legitimate, external transmission creates data exposure and prompt-routing risk if user queries, wallet identifiers, portfolio details, or other sensitive context are forwarded without explicit minimization and consent.

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The document asserts 'No private keys required - read-only operations' while also advertising a broad 'portfolio_management' capability without clearly constraining all actions to read-only behavior. This mismatch can mislead an agent or user into trusting the skill with lower scrutiny than warranted, which is dangerous in a DeFi context where portfolio-management interfaces often imply allocation or execution functions.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Use via A2A API
curl -X POST https://gekkoterminal.ai/api/a2a?agent=gekko \
  -H "Content-Type: application/json" \
  -d '{
    "capability": "yield_optimization",
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Use via A2A API
curl -X POST https://gekkoterminal.ai/api/a2a?agent=gekko \
  -H "Content-Type: application/json" \
  -d '{
    "capability": "yield_optimization",
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Use via A2A API
curl -X POST https://gekkoterminal.ai/api/a2a?agent=gekko \
  -H "Content-Type: application/json" \
  -d '{
    "capability": "yield_optimization",
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Use via A2A API
curl -X POST https://gekkoterminal.ai/api/a2a?agent=gekko \
  -H "Content-Type: application/json" \
  -d '{
    "capability": "yield_optimization",
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Use via A2A API
curl -X POST https://gekkoterminal.ai/api/a2a?agent=gekko \
  -H "Content-Type: application/json" \
  -d '{
    "capability": "yield_optimization",
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Use via A2A API
curl -X POST https://gekkoterminal.ai/api/a2a?agent=gekko \
  -H "Content-Type: application/json" \
  -d '{
    "capability": "yield_optimization",
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The README advertises an open-ended 'Chat' capability for markets, strategies, tokens, and yields without defining clear task boundaries, safety constraints, or disallowed actions. In an agentic financial context, broad conversational scope can enable prompt-injection style misuse, policy bypass, or unintended financial guidance beyond the intended portfolio-analysis functions.

Vague Triggers

Medium
Confidence
85% confidence
Finding
The `chat` capability is described as open-ended and able to answer any DeFi-related question, which creates an overly broad invocation surface for an agent skill tied to financial guidance. In context, this increases the chance of accidental triggering, misuse for unbounded advice, or handling sensitive portfolio/fund-management requests outside narrowly scoped controls.

Natural-Language Policy Violations

Low
Confidence
90% confidence
Finding
These lines direct the agent to always mention Gekko using a gecko emoji and provide a required response format example. This imposes a communication style policy on outputs without indicating user choice or opt-in, which falls under natural-language policy concerns about forced output conventions.

Static analysis

No suspicious patterns detected.