DefiLlama Pro OpenAPI Skill

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 3:37 AM UTC
• Version: 1.0.0

Overview

This skill is a clearly scoped read-only DefiLlama Pro API helper, with the main caution that users must protect the Pro API key because the upstream API puts it in request paths.

Install only if you are comfortable configuring a DefiLlama Pro API key in UXC. Use environment or secret-manager based credential input, avoid verbose logging, sanitize or delete UXC daemon logs after troubleshooting, and verify the OpenAPI schema source before linking if you need reproducible reviewed behavior.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 89% confidence

Finding

The skill instructs users to configure a persistent API credential and host binding in the local UXC auth store, and the API key is injected into the request path. Even though this is needed for functionality, session persistence combined with path-based secrets increases the chance of long-lived credential exposure through local config, process invocation context, or debugging artifacts such as daemon logs. The surrounding skill context makes this somewhat more dangerous because it explicitly notes that keys may appear in request paths and logs.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md

This skill does **not** cover:

- write operations or account management
- the public unauthenticated host variants
- the full DefiLlama Pro endpoint surface

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

md

- Keep automation on the JSON output envelope; do not use `--text`.
- Parse stable fields first: `ok`, `kind`, `protocol`, `data`, `error`.
- Treat this v1 skill as read-only. Do not imply wallet, trading, or admin support.
- This skill assumes the Pro host and key-in-path auth model. Do not bind the same credential to a different path shape without checking the upstream docs first.
- API keys are sensitive because they appear in the request path. Use `--secret-env` or `--secret-op`, not shell history literals, when possible.
- Avoid sharing raw daemon logs when troubleshooting this integration. The key is part of the request path, so if you inspect `~/.uxc/daemon/daemon.log`, sanitize, rotate, or delete the log after debugging and avoid verbose logging unless necessary.
- `defillama-pro-openapi-cli <operation> ...` is equivalent to `uxc https://pro-api.llama.fi --schema-url <defillama_pro_openapi_schema> <operation> ...`.

Static analysis

No suspicious patterns detected.