Security audit

ava

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for Ava DeFi use, but it exposes live financial execution through under-scoped CLI paths that users should review carefully before installing.

Review this skill as a live-money integration. Install only if you trust Ava's API and are comfortable with a local bearer token authorizing financial actions. Keep AVA_TOKEN private, verify previews yourself, avoid the generic call command unless you know exactly which MCP tool is being invoked, and do not set AVA_ENABLE_LIVE=true unless you intentionally want mainnet execution paths enabled.

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The description states that live money is ava_lend_execute on Base (Morpho), implying live execution scope is limited to Base. However, the manifest also declares chains ['base', 'monad', 'bnb', 'avalanche', 'arb'], which broadens the advertised operational scope beyond the stated live-money behavior and can mislead users about where the skill actually operates.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The manifest frames this skill around lending USDC on Base with mandate, preview, and execution flows. However, `cmdCall` allows invoking any MCP tool name with arbitrary JSON arguments, which makes the script a general-purpose Ava MCP client rather than a lending-scoped interface and can reach capabilities beyond the described live-lending purpose.

Description-Behavior Mismatch

Low

Confidence: 76% confidence
Finding: The manifest emphasizes lending real USDC on Base via `ava_lend_execute`, while this CLI also implements testnet swap/copilot flows (`turn`, `approve`) plus `portfolio` and `price` operations. Some of this is hinted at in the manifest, but the code materially broadens the operational surface beyond the stated primary function of capital allocation into lending.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The `cmdLend` function invokes `ava_lend_execute`, which can perform a live lend operation, and then persists state. Although the help text says 'NEVER skip user confirm' and the output hint mentions showing a preview first, the execution path itself does not enforce or display a confirmation prompt before submitting the irreversible action.

Natural-Language Policy Violations

Low

Confidence: 82% confidence
Finding: The `cmdPrice` command hard-codes `vsCurrency: "usd"`, which imposes a specific currency/locale choice in user-facing behavior. There is no opt-in, user selection, or documented justification that this tool is intentionally USD-only.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/ava.mjs:29