Liquid Agent stocks

• Outcome: Review
• Latest audit: Sep 4, 2026 · 4:28 AM UTC
• Version: 1.1.1

Overview

The skill is a coherent on-chain stock-basket helper, but it routes broad investing requests into irreversible financial transactions and optional paid API calls without enough scoping or explicit approval guidance.

Install only if you intend to use Liquid Agent's Base-mainnet tokenized stock basket. Confirm the exact product, amount, wallet, transaction target, and network before signing or broadcasting anything, and require explicit approval before sell, send, rebalance, gas sponsorship, publish, or paid x402 signal calls.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill metadata advertises broad triggers like investing in stocks, buying an index/ETF on-chain, or putting USDC into equities, which overlap with common user intents and can cause the skill to be invoked in situations where the user did not explicitly consent to this specific third-party trading workflow. In a financial skill that can lead to transaction generation and fund movement, overbroad routing increases the chance of unintended high-risk actions.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The example invocation list includes ambiguous phrases such as 'Buy some stocks' and 'cash out to USDC' without guardrails, which can cause the agent to match this skill for generic finance requests. Because the skill prepares blockchain transactions tied to a third-party API, ambiguous activation materially raises the risk of unintended portfolio operations.

External Transmission

Medium

• Category: Data Exfiltration

Content

ME=0xYourAddress
VAULT=$(curl -s $API/v1/balance/$ME | jq -r '.vaults[0].vault')
# 1) get the permit to sign
curl -s -X POST $API/v1/buy -H 'content-type: application/json' \
  -d "{\"vault\":\"$VAULT\",\"usdc\":\"5000000\",\"permit\":true,\"owner\":\"$ME\"}" > permit.json
# 2) sign permit.json .typedData with eth_signTypedData_v4 -> SIG, read DEADLINE from .typedData.message.deadline
# 3) get the single deposit tx

• Confidence: 86% confidence
• Finding: This example sends wallet-linked identifiers such as the owner's address and vault to an external service to obtain typed data and transaction payloads. Although no private key is transmitted and the design is described as self-custodial, this still exposes financial intent and account linkage to a third-party service and introduces dependency on untrusted remote transaction construction.

External Transmission

Medium

• Category: Data Exfiltration

Content

These return HTTP 402 with an x402 v2 challenge. If your runtime can pay x402 (agentcash, an x402 fetch wrapper, or the OpenClaw x402 skill), just retry with payment. Everything above stays free.

- `GET /v1/signals` — **$0.04**. The whole basket's rebalancing signal in one call: per-stock returns, volatility, RSI, trend, relative strength, correlation, and an inverse-volatility `suggestedWeightsBps` you can pass straight to `/v1/set-weights`. Add `?vault=<yours>` for your drift.
- `POST /v1/publish` body `{"vault":"0x…","label":"Alice's stocks"}` — **$0.25** flat. Mints a live shareable portfolio page at `https://api.liquidagent.ai/v/<slug>` for 24 hours; the user opens `viewUrl` with no wallet or login. Re-publish to keep it alive.

## Rules

• Confidence: 78% confidence
• Finding: The paid extras section instructs the runtime to retry with payment against an x402 challenge, which can cause automatic outbound payment to a third-party endpoint. In a financial agent context, any mechanism that may autonomously spend USDC for auxiliary services increases the attack surface and can lead to unintended charges or coercive prompt flows.

External Transmission

Medium

• Category: Data Exfiltration

Content

These return HTTP 402 with an x402 v2 challenge. If your runtime can pay x402 (agentcash, an x402 fetch wrapper, or the OpenClaw x402 skill), just retry with payment. Everything above stays free.

- `GET /v1/signals` — **$0.04**. The whole basket's rebalancing signal in one call: per-stock returns, volatility, RSI, trend, relative strength, correlation, and an inverse-volatility `suggestedWeightsBps` you can pass straight to `/v1/set-weights`. Add `?vault=<yours>` for your drift.
- `POST /v1/publish` body `{"vault":"0x…","label":"Alice's stocks"}` — **$0.25** flat. Mints a live shareable portfolio page at `https://api.liquidagent.ai/v/<slug>` for 24 hours; the user opens `viewUrl` with no wallet or login. Re-publish to keep it alive.

## Rules

• Confidence: 78% confidence
• Finding: The paid extras section instructs the runtime to retry with payment against an x402 challenge, which can cause automatic outbound payment to a third-party endpoint. In a financial agent context, any mechanism that may autonomously spend USDC for auxiliary services increases the attack surface and can lead to unintended charges or coercive prompt flows.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.