KaspaCom DEX MCP

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:58 AM UTC
• Version: 0.1.0

Overview

This skill is a focused DEX helper, but it gives an agent asset-moving swap and liquidity commands without clear human confirmation or transaction-safety guardrails.

Review this skill carefully before installing. Use an isolated or least-privileged environment, pin and verify the npm package version, and require manual approval after checking token identifiers, network, amounts, destination effects, quotes, and slippage before any swap or liquidity command is submitted.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Unpinned Global Installation of a Third-Party npm Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10-12
Vulnerability Type: Unpinned and globally installed third-party dependency
Risk Level: Medium

bash

npm i -g @kaspacom/defi-mcp

Technical Analysis

The installation instructions retrieve the current release of @kaspacom/defi-mcp from the configured npm registry without specifying an exact version or verifying package integrity. Consequently, the code installed by this command can change after the Skill has been reviewed.

npm packages may execute lifecycle scripts during installation. If the package, its publishing account, one of its transitive dependencies, or the configured registry is compromised, malicious code could execute during installation. The -g option installs the package into the global npm environment, increasing its exposure and potentially replacing or introducing commands available across projects.

The dependency's implementation is not included in the audited project, so its runtime behavior and transitive dependency chain could not be verified from the available artifact.

Attack Path

1. An attacker compromises the package publisher, npm account, registry path, or a transitive dependency.
2. The attacker publishes a malicious release that becomes the version selected by the unpinned installation command.
3. A user or agent follows the Skill instructions and runs npm i -g @kaspacom/defi-mcp.
4. npm downloads the mutable release and may execute malicious lifecycle scripts during installation.
5. The installed global CLI can subsequently execute attacker-controlled logic when invoked for price queries, swaps, or liquidity operations.

Impact Assessment

Malicious installation or runtime code would generally execute with the privileges of the account running npm. It could access files, environment variables, wallet-related configuration, network resources, and credentials available to that account. If the com ...[truncated 398 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to a specifically reviewed version, for example:

  bash

  npm install --global @kaspacom/defi-mcp@<audited-exact-version>
  

• Prefer a project-local installation with a committed lockfile over a global installation.
• Verify the package's registry provenance, publisher identity, signatures or attestations, and published integrity metadata before installation.
• Audit the selected package release, its lifecycle scripts, and its complete transitive dependency tree.
• Install and run the CLI under a dedicated, least-privileged account or isolated environment.
• Avoid exposing wallet seed phrases or unrestricted signing keys to the process. Use narrowly scoped transaction-signing controls and require explicit confirmation of destination addresses, token identifiers, amounts, slippage, and network before submitting transactions.
• Establish a controlled update process so newer package versions are reviewed before adoption rather than selected automatically.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill includes executable examples for swaps and liquidity changes, which are irreversible financial operations, but it provides no warning, confirmation requirements, slippage guidance, or reminder to verify network/token parameters. In an agent skill context, this increases the chance that an assistant or user will treat these commands as routine examples and trigger real asset movement without adequate human review.

Content

No source excerpt is available for this finding.