KaspaCom Lending MCP

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:52 AM UTC
• Version: 0.1.0

Overview

This skill is purpose-aligned for KaspaCom lending, but it gives an agent fund-affecting transaction commands without enough safety boundaries.

Review this carefully before installing. Use it only for explicit KaspaCom lending tasks, pin and verify the npm package if possible, avoid installing with elevated privileges, and require manual review of wallet, network, token, amount, and transaction payload before any supply, borrow, or repay action.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Unpinned Global npm Dependency Creates a Supply-Chain Execution Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10–13
Vulnerability Type: Unpinned third-party package installed globally
Risk Level: Medium

Vulnerable code:

markdown

## Install
```bash
npm i -g @kaspacom/defi-mcp

text

### Technical Analysis

The installation command retrieves the package version currently selected by the npm registry rather than an exact, previously audited version. Consequently, the effective code installed by this Skill can change without any corresponding change to `SKILL.md`.

npm packages can define lifecycle scripts that execute during installation. Because the package is installed globally, those scripts and the resulting CLI run with the permissions of the invoking user and can modify that user's environment. This creates a supply-chain risk if the package, a transitive dependency, the publisher account, or the registry delivery path is compromised.

The audited file does not establish that `@kaspacom/defi-mcp` is currently malicious. The vulnerability is the mutable and unverified dependency installation process.

### Attack Path

1. An attacker compromises the npm publisher account, package, or one of its transitive dependencies.
2. The attacker publishes a malicious version that becomes the version resolved by the unpinned installation command.
3. A user follows the Skill instructions and runs `npm i -g @kaspacom/defi-mcp`.
4. npm downloads the attacker-controlled release and may execute its lifecycle scripts during installation.
5. Malicious code executes with the invoking user's permissions; the globally installed CLI can also execute attacker logic during later lending commands.

### Impact Assessment

Successful exploitation could provide arbitrary code execution with the privileges of the user running npm. This may permit access to that user's files, environment variables, CLI configuration, and wallet-related data available in the execution environmen
...[truncated 367 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the dependency to an exact version that has been independently reviewed, for example @kaspacom/defi-mcp@X.Y.Z, rather than relying on a mutable distribution tag.
• Verify the package against an expected integrity hash and document the trusted publisher, source repository, and npm registry.
• Prefer a project-local installation governed by a committed lockfile instead of modifying the user's global npm environment.
• Review both the direct package and its transitive dependencies before approving upgrades.
• Disable lifecycle scripts during installation with --ignore-scripts when the package can operate without them. If scripts are required, inspect them before installation.
• Execute the CLI in a restricted environment with least-privilege filesystem access and no unnecessary secrets or wallet material.
• Require explicit user review and confirmation of network, token, amount, destination, and transaction payload before signing or submitting any lending transaction.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill includes direct transaction examples for supply, borrow, and repay but provides no warning that these actions can move funds, alter collateralization, incur debt, or trigger liquidation risk. In an agent setting, presenting transaction-capable commands without explicit safety guidance makes accidental or insufficiently authorized execution more likely.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill description is broad enough to trigger on generic lending, collateral, borrow, and Aave-style requests, which increases the chance an agent invokes this skill in situations the user did not explicitly intend. Because the skill can perform fund-affecting actions, ambiguous activation materially raises the risk of unintended on-chain transactions or position changes.

Content

No source excerpt is available for this finding.