T09 · Insecure Skill Coding Practices
Error
- Location
scripts/ava.mjs:49- Finding
Bearer Token Can Be Forwarded to an Arbitrary Configured Endpoint
- Content
View full analysis
- Remediation
View remediation
Security audit
ava
Security checks for vulnerabilities and agentic risk
Overview
This skill is clearly meant for Ava DeFi workflows, but its packaged CLI exposes broader and less clearly bounded financial authority than the instructions promise.
Install only if you are comfortable reviewing a live-finance skill carefully. Use the dedicated two-phase lend flow, do not set AVA_ENABLE_LIVE unless you fully understand the effect, avoid the generic call command for state-changing tools, keep the stored bearer token protected, use the official API endpoint unless intentionally developing locally, and prefer pinned or verified installer versions instead of unpinned npx commands.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/ava.mjs:246- Finding
Testnet-Only Approval Command Can Request Mainnet Execution
- Content
View full analysis
(or run turn first to cache lastExecutionId)"); } const uid = requireUserId(); requireToken(); const live = env("AVA_ENABLE_LIVE", "") === "true"; const result = await mcpCall("ava_approve_execute", { executionId: id, userId: uid, portal: portal(), mode: live ? "mainnet" : "testnet", }); printJson(result); } ``` This behavior conflicts with the explicit safety rule in `SKILL.md:95-106`: ```text 1. Live money is `ava_lend_execute` on Base (Morpho). Never use `ava_copilot_turn`, `ava_preview_tx`, or `ava_approve_execute` for live or mainnet funds. ... 6. Copilot / `preview_tx` / `approve_execute` are testnet only. ``` ### Technical Analysis The Skill repeatedly represents `ava_approve_execute` as testnet-only and states that live capital must use the two-phase `ava_lend_execute` workflow. The implementation contradicts that security boundary by changing the approval request to `mode: "mainnet"` whenever `AVA_ENABLE_LIVE` equals `"true"`. The `approve` command does not perform an interactive confirmation, validate that the execution originated in testnet mode, display a fresh preview, or enforce the documented `previewHash` workflow. Consequently, an environment variable can transform a command presented as testnet-only into a mainnet request. Although the remote service may independently reject this request, the local Skill does not fail closed as documented. Client-side safety must not depend on undocumented server behavior. ### Attack Path 1. A copilot operation returns an `executionId`, which the CLI may cache as `lastExecutionId`. 2. `AVA_ENABLE_LIVE=true` is s ...[truncated 1076 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/ava.mjs:275- Finding
Generic Authenticated Tool Dispatcher Bypasses Command-Specific Safety Controls
- Content
View full analysis
''"); let args = {}; if (jsonArgs) { try { args = JSON.parse(jsonArgs); } catch (e) { fail(`Invalid JSON args: ${e.message}`); } } printJson(await mcpCall(tool, args)); } ``` The dispatcher is exposed from `scripts/ava.mjs:354-356`: ```js case "call": return cmdCall(rest[0], rest.slice(1).join(" ")); ``` ### Technical Analysis `cmdCall()` accepts an arbitrary MCP tool name and arbitrary JSON arguments, then invokes that tool using the stored bearer token. It does not enforce an allowlist, distinguish read-only operations from financial execution, or reject tools that are supposed to pass through dedicated preview and confirmation workflows. This creates a local privilege-boundary bypass. The dedicated `lend`, `turn`, and `approve` commands provide workflow-specific hints and partial checks, but the generic dispatcher can call the underlying tools directly. It can also invoke newly added server tools that were never reviewed as part of this Skill, provided the authenticated server exposes them. Server-side authorization remains an important final control, but the Skill explicitly claims that live execution follows a particular two-phase procedure. A generic authenticated dispatcher does not enforce that claim and grants broader capabilities than required for the documented CLI examples. ### Attack Path 1. An attacker or compromised agent obtains the name and arguments of an MCP tool from server metadata or documentation. 2. The attacker instructs the CLI to run `node scripts/ava.mjs call ''`. 3. `cmdCall()` parses the supplied arguments but performs no authorization or operation-type validation. 4. `mcpCall( ...[truncated 1008 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:70- Finding
Documentation Executes an Unpinned Third-Party Package Through npx
- Content
View full analysis
- Remediation
View remediation
`. 2. Document the expected package integrity hash and verified source repository. 3. Publish package provenance and signed releases. 4. Prefer installation through a lockfile-controlled project dependency instead of executing the latest remote package directly. 5. Instruct users to inspect package identity and provenance before execution. 6. Establish a release-review process ensuring that the pinned version is updated only after security review. 7. Where practical, include the required connection functionality in the reviewed Skill rather than delegating configuration changes to mutable remote code. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (21)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/ava.mjs health
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/ava.mjs health
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/ava.mjs health
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/ava.mjs health
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/ava.mjs health
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/ava.mjs health
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/ava.mjs health
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/ava.mjs health
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/ava.mjs health
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file comments and usage text say
approveis testnet-only, butcmdApprovewill submitmode: "mainnet"wheneverAVA_ENABLE_LIVE=true. In a money-moving context, misleading operators about network scope can cause accidental live approvals and real financial loss, especially when downstream agents rely on comments/help text as safety signals.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
The README instructs users to run an unpinned package via
npx skills, which fetches and executes code at install time without locking to a reviewed version. In a financial/agent-wallet context, a compromised upstream package, typosquat, or malicious newly published version could lead to arbitrary code execution on the user's machine and potentially tamper with trading or wallet-related workflows.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The command
npx @getava-xyz/connectexecutes the latest published package version by default, creating a supply-chain risk if the package or publisher account is compromised. Because this skill is explicitly for live USDC lending and DeFi operations, compromise of the bootstrap/connect tool could redirect API endpoints, exfiltrate secrets, alter transaction parameters, or mislead users during a high-value workflow.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill exposes network and environment-related capabilities but does not declare any explicit tool scope or allowed-tools boundary. In a finance-oriented skill that can connect to live MCP endpoints and handle bearer-token-based sessions, this weakens least-privilege controls and increases the chance that an agent can invoke unintended capabilities or operate with broader access than the user expects.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 90% confidence
- Finding
Referencing an MCP bootstrap command in the manifest without version pinning embeds a mutable dependency into the skill's advertised setup path. Since this skill enables agent-mediated movement of real funds, any compromise in that dependency chain can have outsized consequences compared to ordinary developer tooling.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
Using
npx @getava-xyz/connectwithout a pinned version causes execution of whatever package version is current at install time, creating a supply-chain risk. Because this skill is specifically designed to configure financial MCP access and bearer-token connectivity, a compromised or malicious upstream package could alter MCP configuration, exfiltrate tokens, or redirect users to attacker-controlled infrastructure.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad and include terms like 'trading', 'finance tools', and 'agentic finance', which can cause the skill to activate in loosely related contexts. Because this skill can lead to live financial actions, over-broad activation increases the risk of inappropriate invocation, user confusion, or an agent steering into money-moving workflows when the user did not clearly intend that.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
This unpinned
npxinvocation repeats the same supply-chain exposure in the body of the skill, increasing the likelihood users will execute a mutable package. In the context of a DeFi automation skill, compromise of the bootstrap package could directly affect live-money workflows, session handling, and trust boundaries around remote MCP setup.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The script exposes swap/trade-style copilot and approval flows (
turn,approve) even though the skill metadata emphasizes lending-focused behavior. This scope mismatch is dangerous because users, agents, or policy layers may trust the manifest and permit the skill under narrower assumptions, while the code enables materially different financial actions.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The generic
callcommand allows arbitrary MCP tool invocation with attacker-supplied JSON, bypassing the CLI's safer, opinionated flows such as two-phase preview and explicit command-specific guardrails. In a financial skill handling live capital, this materially expands the reachable attack surface to any server-exposed tool, including future or undocumented capabilities not reflected in the manifest.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 70% confidence
- Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
- Content