ClawHub
Back to skill

Security audit

Morpho CLI

Security checks for vulnerabilities and agentic risk

Overview

This Morpho skill is coherent, but it should be reviewed because it runs an unpinned npm CLI while preparing DeFi transaction payloads.

Review before installing. Use only a pinned, reviewed version of the Morpho CLI or a locked local install, run it with minimal filesystem and environment access, and independently verify chain IDs, contract addresses, approval spenders, amounts, warnings, and simulation results before signing anything in a wallet. Do not expose private keys or unnecessary credentials to the agent environment.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:20
Finding

Execution of an Unpinned Third-Party npm Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 20
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code:

bash
npx @morpho-org/cli <command> [options]

Technical Analysis

The Skill instructs the agent to execute @morpho-org/cli through npx without specifying an exact package version. The project does not include a lockfile, integrity hash, vendored implementation, or other mechanism that binds execution to the version reviewed during this audit.

When a suitable local package is unavailable, npx may resolve and download the package from the npm registry. The code ultimately executed can therefore change after the Skill has been audited. A compromised maintainer account, malicious package release, registry compromise, or compromised transitive dependency could introduce arbitrary executable behavior.

The package name is consistent with the Skill's declared Morpho functionality, and there is no evidence in the audited files that the current package is malicious. The vulnerability is the unsafe dependency resolution and execution model rather than confirmed malicious package content.

Attack Path

  1. An attacker compromises the package publication process, a package maintainer account, the npm distribution channel, or a transitive dependency.
  2. The attacker publishes a malicious version that remains compatible with the unversioned package reference.
  3. A user asks the agent to perform a Morpho query, transaction preparation, or simulation.
  4. Following SKILL.md, the agent invokes npx @morpho-org/cli without an exact version.
  5. npx resolves the attacker-controlled release and downloads it if it is not already available locally.
  6. Package installation or runtime code executes with the permissions of the account running the agent.
  7. The malicious code can access data and resources available to that process, potentially befor ...[truncated 1042 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the CLI to an exact version that has been independently reviewed:
    bash
    npx --yes @morpho-org/cli@<reviewed-exact-version> <command> [options]
  2. Do not use version ranges or tags such as latest, because they preserve the ability for executable behavior to change without review.
  3. Install the dependency through a committed package manifest and lockfile, and use a reproducible installation method such as npm ci.
  4. Verify npm package provenance, signatures where available, and registry integrity metadata before approving upgrades.
  5. Review the package and its transitive dependency changes before updating the pinned version.
  6. Prefer vendoring or shipping auditable implementation code where operationally feasible.
  7. Execute the CLI in a sandbox with minimal filesystem access, restricted environment variables, no private-key access, and tightly controlled network permissions.
  8. Independently validate transaction destination addresses, chain IDs, calldata intent, approval spenders and amounts, simulation results, and warnings before presenting unsigned transactions to the user.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (19)

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The skill instructs use of npx @morpho-org/cli without pinning an exact package version, so each invocation may fetch and execute whatever version is currently published to npm. Because this skill is explicitly used to prepare DeFi transactions, a compromised or malicious upstream package update could alter transaction data, approvals, or displayed results and directly influence asset-moving actions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This command example relies on an unpinned npx package, which allows remote code execution from the latest published package version at runtime. In a financial protocol skill, that creates meaningful supply-chain risk because the tool's output shapes user decisions about deposits, withdrawals, borrowing, and repayments.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

Using npx @morpho-org/cli without a fixed version means the command is nondeterministic and can execute newly published code without review. Since this skill handles market data that may drive lending decisions, a hostile update could manipulate values or behavior in ways that cause financial loss.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The command example fetches the latest CLI package at runtime, which exposes users to malicious package replacement, maintainer compromise, or dependency hijacking. In the context of querying user positions and protocol state, falsified output could mislead risk assessments and subsequent asset-management actions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

An unpinned npx invocation allows arbitrary newer package code to run under the user's environment whenever the skill is used. Because the command pertains to user addresses and vault positions, a compromised package could tamper with outputs or exfiltrate sensitive wallet-related metadata.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This example uses an unversioned CLI package for preparing a deposit transaction, which is especially sensitive because the generated unsigned transactions may later be signed by a wallet. A malicious package update could inject harmful approvals, wrong recipient addresses, or misleading simulation output.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

Preparing a withdrawal via an unpinned remotely fetched CLI introduces supply-chain risk into a workflow that directly affects fund movements. If the package is compromised, it could craft malicious calldata or misrepresent liquidity and withdrawal details, leading to user loss.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

This command prepares a supply transaction using an unpinned npm package, so execution depends on the latest registry state rather than a reviewed artifact. In a DeFi context, that can enable silent tampering with transaction construction or approvals, creating a realistic path to financial harm.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

Borrow preparation is a high-sensitivity workflow, and invoking an unpinned npx package means the code that calculates and generates transaction payloads can change without notice. A compromised release could manipulate borrow parameters, previews, or warnings and induce unsafe or malicious financial actions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

An unpinned runtime-fetched CLI is dangerous in a repay flow because malicious code can alter transaction payloads or surrounding approval logic while still appearing legitimate. Since users may trust the skill's simulation and summaries, manipulated output could lead to unnecessary approvals or misdirected transactions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

Supplying collateral through an unpinned npx package gives a potentially mutable upstream package control over transaction generation for a leveraged lending workflow. That materially increases the blast radius of a supply-chain compromise, including unauthorized approvals or harmful collateral operations.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

Collateral withdrawal is a risk-sensitive action that can affect liquidation health, and using an unpinned CLI means unreviewed code may shape the generated transactions and warnings. A compromised package could suppress danger signals or craft payloads that worsen a user's position or redirect assets.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

Even though this command is for simulation, an unpinned npx package still executes remote code from the latest npm version and can falsify simulation results or inspect provided transaction/context data. That can mislead users into believing unsafe operations are safe or leak sensitive strategy information.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The utility command still uses an unpinned package, so merely checking health can trigger execution of unreviewed upstream code. While less sensitive than transaction preparation, it remains a supply-chain foothold that could be used for environment compromise or deceptive status reporting.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

Fetching supported chains via an unpinned npx package is still a live remote-code execution event subject to npm supply-chain attacks. Although the direct asset impact is lower for this specific command, it normalizes unsafe package execution throughout the skill and can provide an attacker initial code execution opportunity.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The write-workflow guidance repeatedly tells users to run prepare-* commands backed by an unpinned npx package, embedding supply-chain risk into the core transaction-preparation process. Because the skill's purpose is to build unsigned DeFi transactions, any malicious update can directly influence actions that users may later sign on-chain.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

This line reinforces use of simulate-transactions without pinning the package version, again allowing mutable upstream code execution. In context, false or manipulated simulation output can meaningfully distort user decisions even if the command itself does not broadcast transactions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The error-handling section explicitly references npx @morpho-org/cli without version pinning, perpetuating the same unsafe execution pattern across operational guidance. This broad repetition increases exposure because users are encouraged to rely on the latest package behavior in normal and failure scenarios alike.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

This markdown file documents commands that retrieve user-address-scoped positions, balances, allowances, permit nonces, and transferability, which are wallet-related data points that can affect user privacy. The description provides no caution that invoking these commands reveals sensitive account information, despite SQP-2 applying to markdown files when behaviors could affect user data or privacy.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.