T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/monitor.js:144- Finding
Configurable liquidation thresholds are ignored by the risk calculation
- Content
View full analysis
- Remediation
View remediation
Security audit
Aave Liquidation Monitor
Security checks for vulnerabilities and agentic risk
Overview
This is a read-only Aave monitoring skill, but its alerting and automation claims are not fully supported by the packaged implementation and could cause users to miss financial-risk alerts.
Review carefully before installing if you intend to rely on this for liquidation protection. It does not request private keys or sign transactions, but it sends wallet-position queries to Aave, may route position details through your configured messaging service, runs persistently when enabled, and currently may ignore custom alert thresholds.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/monitor.js:32- Finding
Exported monitoring function interpolates an unvalidated wallet value into GraphQL queries
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (19)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill claims proactive liquidation monitoring, configurable thresholds, scheduling, and alert delivery, but the analyzed content does not substantiate those capabilities. This mismatch is dangerous because users may rely on the skill for time-sensitive liquidation protection and believe they are being monitored when they are not, leading to missed alerts and potential financial loss. Security-wise, inaccurate claims also undermine trust boundaries and make it harder to assess what data is actually processed or transmitted.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Edit `scripts/monitor.js` to add chains or customize per-chain endpoints.
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md Edit `scripts/monitor.js` to add chains or customize per-chain endpoints.
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill advertises network-dependent monitoring behavior but does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization and review gap: operators cannot easily verify what external access the skill is intended to use, and a runtime may grant broader network capability than expected. In a monitoring skill that sends wallet data to external APIs, undeclared network use weakens least-privilege controls.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 85% confidence
- Finding
This finding duplicates the example request already flagged at the same line and reflects the same issue: user wallet data is transmitted to an external API. In this skill's context, such transmission is necessary for functionality, so the danger is limited to privacy and disclosure concerns rather than code execution or credential theft.
- Content
Request
bash curl -X POST https://api.v3.aave.com/graphql \ -H "Content-Type: application/json" \ -d '{ "query": "query GetUserPosition($address: String!) { userAccount(id: $address) { healthFactor totalCollateralBase totalDebtBase } }",
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 85% confidence
- Finding
This finding duplicates the example request already flagged at the same line and reflects the same issue: user wallet data is transmitted to an external API. In this skill's context, such transmission is necessary for functionality, so the danger is limited to privacy and disclosure concerns rather than code execution or credential theft.
- Content
Request
bash curl -X POST https://api.v3.aave.com/graphql \ -H "Content-Type: application/json" \ -d '{ "query": "query GetUserPosition($address: String!) { userAccount(id: $address) { healthFactor totalCollateralBase totalDebtBase } }",
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The guide states the wallet address is never sent to external services except Aave's public GraphQL API, but the same document configures alerts via Telegram, Discord, or Slack. Even if the raw address is not transmitted, alert contents about liquidation risk, health factor, labels, or account status can reveal wallet-linked financial information to third-party messaging platforms, making the privacy claim misleading.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The guide describes persistent background execution, logging, and alert routing of wallet-related monitoring data without a prominent privacy warning or explicit consent step. Even if the wallet address is public on-chain, tying it to a user's configured channels, monitoring cadence, health factor history, and session logs creates sensitive behavioral metadata that may be stored or exposed longer than users expect.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md * node monitor.js 0x1234...5678 ethereum */ const AAVE_GRAPHQL_ENDPOINT = 'https://api.v3.aave.com/graphql'; const CHAIN_CONFIG = { ethereum: {
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md * node monitor.js 0x1234...5678 ethereum */ const AAVE_GRAPHQL_ENDPOINT = 'https://api.v3.aave.com/graphql'; const CHAIN_CONFIG = { ethereum: {
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md * node monitor.js 0x1234...5678 ethereum */ const AAVE_GRAPHQL_ENDPOINT = 'https://api.v3.aave.com/graphql'; const CHAIN_CONFIG = { ethereum: {
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md * node monitor.js 0x1234...5678 ethereum */ const AAVE_GRAPHQL_ENDPOINT = 'https://api.v3.aave.com/graphql'; const CHAIN_CONFIG = { ethereum: {
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md * node monitor.js 0x1234...5678 ethereum */ const AAVE_GRAPHQL_ENDPOINT = 'https://api.v3.aave.com/graphql'; const CHAIN_CONFIG = { ethereum: {
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md * node monitor.js 0x1234...5678 ethereum */ const AAVE_GRAPHQL_ENDPOINT = 'https://api.v3.aave.com/graphql'; const CHAIN_CONFIG = { ethereum: {
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
js * node monitor.js 0x1234...5678 ethereum */ const AAVE_GRAPHQL_ENDPOINT = 'https://api.v3.aave.com/graphql'; const CHAIN_CONFIG = { ethereum: {
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The manifest describes a proactive monitoring and notification skill that sends alerts through external messaging channels and supports continuous monitoring or periodic summaries. In this file, the implemented behavior is limited to a single CLI invocation that fetches one wallet position, writes output to stdout/stderr, and exits with a status code; there is no messaging integration or ongoing monitoring loop.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The documentation instructs sending wallet addresses and position data to Aave's public GraphQL endpoint without any privacy notice or data-handling caveat. While wallet addresses are public on-chain, transmitting user-selected addresses and query timing to a third-party service can still leak portfolio interest, monitoring behavior, and chain usage metadata.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This markdown file describes a destructive operation:
/aave-config resetremoves the user's saved configuration. Although line L284 says it 'wipes all settings,' the section lacks a clearer caution before the command block about irreversible loss of existing configuration and the need to back up or confirm before running it.- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The function signature suggests configurable thresholds via the
thresholdsparameter, which matches the manifest's statement that thresholds are configurable. However, the function ignores that parameter and instead uses hard-coded thresholds throughcalculateHealthFactorRisk, so the code does not fully implement the claimed configurability.- Content
Static analysis
No suspicious patterns detected.