Security audit

LI.FI MCP Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed LI.FI MCP usage guide for read-only cross-chain discovery and quote workflows, with privacy cautions users should keep in mind.

Install only if you are comfortable using LI.FI's hosted MCP endpoint through uxc. Use wallet addresses and API keys only when needed, prefer environment variables for secrets, and treat quotes/status/balance checks as sharing financial metadata with the LI.FI service. The skill does not instruct the agent to sign or broadcast transactions.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description says this skill uses the LI.FI MCP server through UXC to perform cross-chain discovery and monitoring tasks. The supplied code does not interact with LI.FI, UXC, blockchain data, balances, allowances, quotes, or transfer status at all. Instead, it is a local bash script used to validate that certain skill files exist and contain required strings and prohibited patterns. That is a materially different primary purpose, so this is a clear description/behavior mismatch.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The quote and route examples instruct users to submit wallet addresses, token selections, chain IDs, and amounts to a third-party LI.FI service without any privacy or data-sharing warning. In a blockchain context, wallet addresses are persistent identifiers and transaction intent data can reveal holdings, counterparties, and planned activity, so omission of this warning can lead users to disclose sensitive financial metadata unintentionally.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill encourages submitting wallet addresses and querying balances or allowances against a third-party remote endpoint, but it does not explicitly warn that this shares potentially sensitive financial metadata with that service. While blockchain addresses are often public, linking a user's address to their current activity, planned routes, balances, and approval state can create privacy and profiling risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: Documenting API key validation against an external endpoint without warning that credentials will be transmitted may cause users to test real keys in environments where logging, shell history, or untrusted infrastructure can expose them. While this is a common operation, the missing caution increases the chance of accidental credential disclosure or misuse.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.