Security audit

Kelp Forest

Security checks for vulnerabilities and agentic risk

Overview

This skill is a DeFi staking guide that is mostly coherent, but it asks users to handle live wallet keys and grant broad on-chain asset permissions without enough safety controls.

Review carefully before installing or following this skill. Use only a dedicated low-value wallet, independently verify every contract address and chain ID, prefer a hardware wallet or keystore instead of raw private keys, approve only the exact amount needed, revoke leftover allowances, and treat LP NFT staking as transferring custody to a contract with real loss risk.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: skill.md:128
Finding: Unpinned Third-Party Dependency Creates Supply-Chain Risk
Content: View full analysis
Remediation: View remediation
``` 2. Include a reviewed `package.json` and lockfile in the project. 3. Direct users to install dependencies with: ```bash npm ci ``` 4. Verify and review the resolved dependency tree before distribution. 5. Use package integrity controls and a trusted registry. 6. Disable package lifecycle scripts where they are unnecessary: ```bash npm ci --ignore-scripts ``` 7. Run wallet-signing software in a restricted environment and prefer an external or hardware signer so that dependencies cannot directly read raw private keys. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: skill.md:89
Finding: Excessive MOLT Token Allowances Violate Least Privilege
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: skill.md:609
Finding: Raw Wallet Private Key Is Passed Through Process Arguments
Content: View full analysis
--rpc-url $RPC --private-key $PK cast send $FOREST_V4 "harvest(uint256)" --rpc-url $RPC --private-key $PK cast send $FOREST_V4 "harvestAll()" --rpc-url $RPC --private-key $PK cast send $FOREST_V4 "unstake(uint256)" --rpc-url $RPC --private-key $PK cast send $FOREST_V4 "autoHarvest(address[])" "[0xUSER1,0xUSER2]" --rpc-url $RPC --private-key $PK ``` ### Technical Analysis The documented commands expand `$PK` and pass the raw private key to `cast` through the `--private-key` command-line argument. While a normal interactive shell generally records the literal command rather than the expanded value in history, the expanded secret may be exposed through process argument inspection, shell tracing, CI/CD diagnostics, terminal recording, error reporting, endpoint monitoring, or command-execution wrappers. Any process or user able to inspect the arguments during execution may recover the private key. This risk is especially significant because the same wallet is used to approve tokens, transfer LP NFTs, and sign contract calls. ### Attack Path 1. The user exports the wallet private key into `$PK`. 2. The user runs one of the documented `cast send` commands. 3. The shell expands `$PK`, placing the raw private key in the spawned process' ...[truncated 901 chars]
Remediation: View remediation
"" \ --account kelp-agent \ --rpc-url "$RPC" ``` 3. Prefer a hardware wallet, isolated signing service, or other external signer for wallets holding valuable assets. 4. Ensure signing tools prompt users to review the destination, chain ID, function selector, token amount, and allowance before authorization. 5. Disable shell tracing before any operation that handles secrets and prevent CI systems from printing command arguments. 6. Avoid placing private keys in persistent shell startup files or plaintext configuration files. 7. If a private key has already appeared in process logs, traces, or monitoring systems, treat it as compromised and migrate all assets and permissions to a newly generated wallet. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script requests an effectively unlimited ERC-20 approval via a very large allowance, which exposes the user's MOLT balance to unrestricted spending by the approved contract for as long as the approval remains active. If the contract is compromised, upgraded maliciously, or behaves unexpectedly, a user can lose substantially more than the intended staking amount.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The instructions tell users to transfer Uniswap V3 LP NFTs directly into the staking contract, which transfers custody of valuable positions and may apply fees or expose the assets to contract-specific risks. Without an explicit warning, users may not understand that the NFT leaves their wallet, may be difficult to recover if the contract misbehaves, and can represent significant underlying capital.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill directs users to provide a live wallet private key and execute real on-chain transactions, but it does not include clear safety guidance about key custody, use of burner wallets, chain verification, transaction review, or the risk of irreversible loss of funds. In a DeFi staking context, this omission is dangerous because users may paste production keys into ad hoc scripts and expose assets to theft or operational mistakes.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.