Security audit

Passive Savings Crypto

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real crypto wallet tool that can approve, deposit, and transfer funds, but its user-facing framing understates the protocol, approval, and asset-conversion risks.

Review this carefully before installing in any wallet with meaningful funds. Use a dedicated low-balance wallet, verify the Linea contract addresses and sUSDC transfer semantics, avoid or revoke unlimited USDC allowances, and require explicit human approval before any deposit or transfer.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/mintSYT.js:43
Finding: Unlimited USDC Approval Exposes Current and Future Wallet Funds
Content: View full analysis
`. 2. The script detects that the existing allowance is below the deposit amount. 3. The wallet signs an approval granting the router an allowance of `maxUint256`. 4. The requested deposit completes, but the unused authorization remains active. 5. The wallet later receives or retains additional USDC. 6. An attacker compromises or exploits the approved router, or otherwise gains the ability to invoke its token-spending capability. 7. The attacker uses the persistent allowance to transfer USDC from the wallet without a new approv ...[truncated 348 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/getSYTBalance.js:25
Finding: Balance Tool Omits the Promised Underlying USDC Valuation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/transferSYT.js:43
Finding: Payment Tool Directly Calls sUSDC Transfer Despite Guaranteeing Plain USDC Delivery
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (28)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill metadata claims there are 'no protocol interactions, no special steps,' but the documentation clearly describes minting into sUSDC, rebasing balance semantics, and transfers mediated through specialized SYT logic backed by yield-bearing infrastructure. This mismatch can mislead users or agents into treating the asset like plain USDC, causing uninformed fund movement, hidden protocol exposure, and underestimation of smart-contract and custody risk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The description claims 'no protocol interactions' and 'no special steps,' but the README later documents explicit DeFi actions: approving token spending, minting into a yield product, and interacting with Aave-backed infrastructure. This mismatch can mislead users or autonomous agents into treating a risky onchain conversion as ordinary cash handling, increasing the chance of unintended approvals and deposits.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill is framed as passive savings for idle USDC, but it also enables transfers to arbitrary recipient addresses and direct token interactions not implied by the passive-yield marketing. In an agent context, broad payment capability hidden behind a savings-oriented description can lead to unsafe automatic invocation for routine wallet requests and accidental fund movement.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill is framed as passive savings for idle USDC, but it also enables transfers to arbitrary recipient addresses and direct token interactions not implied by the passive-yield marketing. In an agent context, broad payment capability hidden behind a savings-oriented description can lead to unsafe automatic invocation for routine wallet requests and accidental fund movement.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill is framed as passive savings for idle USDC, but it also enables transfers to arbitrary recipient addresses and direct token interactions not implied by the passive-yield marketing. In an agent context, broad payment capability hidden behind a savings-oriented description can lead to unsafe automatic invocation for routine wallet requests and accidental fund movement.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill is framed as passive savings for idle USDC, but it also enables transfers to arbitrary recipient addresses and direct token interactions not implied by the passive-yield marketing. In an agent context, broad payment capability hidden behind a savings-oriented description can lead to unsafe automatic invocation for routine wallet requests and accidental fund movement.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.18.3 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

Category: Supply Chain
Confidence: 94% confidence
Finding: The lockfile pins a direct/transitive dependency on ws 8.18.3, and the reported advisories describe memory disclosure and memory-exhaustion denial of service in that package. In an agent skill that may connect to blockchain nodes or other services over WebSockets, a vulnerable ws version can expose the process to remote crashes, resource exhaustion, or unintended data exposure if an attacker can influence or operate the remote endpoint.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill description claims there are 'no protocol interactions' and 'no special steps,' but the script explicitly submits an ERC-20 approval transaction and then a protocol deposit transaction. This is dangerous because users or downstream agents may consent under false assumptions, causing funds to be committed to a third-party contract and exposed to approval/deposit risk they were told did not exist.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script directly invokes an on-chain ERC-20 transfer using the user's private key, which materially contradicts the skill description claiming passive yield with 'no protocol interactions, no special steps.' This mismatch is dangerous because an agent or user may authorize the skill under false assumptions and unintentionally move tokenized savings assets out of the wallet.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest and metadata claim there are 'no protocol interactions' and 'no special steps,' but the tool explicitly performs a protocol-specific deposit into autoHODL and auto-handles token approval. That mismatch can mislead users or agents into authorizing DeFi actions with custody, approval, yield, and counterparty risks they may not realize they are taking.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill handles private-key-driven minting, balance interpretation, and token transfers involving real on-chain assets, but it does not present clear user-facing warnings about financial risk, irreversible transactions, protocol dependency, or key sensitivity. In an agent setting, this is more dangerous because autonomous systems may execute transfers or conversions without the human operator appreciating that mistakes cannot be easily undone.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation markets the funds as moving 'like regular USDC,' yet also states that spending must go through transferSYT.js and warns never to use raw USDC transfers. That contradiction can cause operators or downstream agents to assume standard ERC-20 behavior when the asset actually has nonstandard transfer semantics, increasing the chance of mistaken transfers, accounting errors, or operational loss.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The text says funds 'move like regular USDC,' but the skill actually converts assets into sUSDC/SYT, a distinct rebasing token with different transfer semantics, redemption assumptions, and risk profile. Misrepresenting a wrapped/yield-bearing token as regular USDC can cause agents or users to make unsafe accounting, transfer, or liquidity decisions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: Using npx clawhub@latest install passive-savings-crypto executes whatever package version is current at install time, creating a supply-chain trust risk. In a wallet/agent skill context, an unexpected CLI update or compromise could install altered skill content or run unreviewed code on the user's machine.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 39)May include surrounding context.
npm run install-skill

text
`npm run install-skill` copies `SKILL.md` to `~/.claude/skills/passive-savings-crypto/SKILL.md` — the directory Claude Code scans for user-installed skills. You only need to run it once, or again after pulling updates. ---

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.
npm run install-skill

text
`npm run install-skill` copies `SKILL.md` to `~/.claude/skills/passive-savings-crypto/SKILL.md` — the directory Claude Code scans for user-installed skills. You only need to run it once, or again after pulling updates. ---

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill declares access to sensitive environment variables, including a private key, but does not define an explicit tool scope or permission boundary. In an agent setting, that increases the chance of over-broad invocation and secret exposure through unintended tool use or unsafe integrations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The invocation examples are broad enough to match common wallet-help requests such as checking balances or sending funds. In an agent ecosystem, overly broad trigger phrases can cause the skill to be selected in contexts the user did not intend, which is especially risky because the skill can initiate real blockchain actions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The statement that Claude Code can invoke the skill automatically when asked about balances, deposits, or transfers lacks clear trigger boundaries. Because the skill has wallet and transfer capability, ambiguous automatic invocation increases the chance of accidental use, context confusion, or routing sensitive finance requests to the wrong skill.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script is presented as handling idle USDC, but it actually reads balances for a specific SYT/sUSDC token contract. That mismatch can mislead users or downstream agents about what asset is being tracked, creating a deceptive asset view and increasing the chance of incorrect financial decisions or unintended exposure to a different instrument than plain USDC.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The code flow requires a conditional approval before deposit, which directly contradicts the claim that there are 'no special steps.' In an agent setting, misleading workflow descriptions are security-relevant because they can suppress scrutiny around approvals and cause users to authorize token access they did not expect.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script grants maxUint256 approval to the router, giving it indefinite authority to spend the wallet's USDC beyond the immediate deposit amount. If the router is compromised, upgraded maliciously, misconfigured, or later behaves unexpectedly, the wallet's USDC can be drained without any further user action.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code comments and UX language imply ordinary USDC semantics, but the contract address and log messages show the script is actually handling sUSDC/SYT, a distinct tokenized asset. This can mislead users or agents into transferring a wrapped/yield-bearing token they may not understand, creating risk of asset confusion, accounting mistakes, and unintended fund movement.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script silently loads a private key and uses it to sign a live asset transfer without any user-facing warning, consent gate, or operational safeguards. In the context of an agent skill marketed as passive savings, undisclosed private-key use is more dangerous because users may not expect the skill to possess or exercise spend authority over wallet funds.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The transfer tool says funds 'move like regular USDC,' but the implementation routes transfers through sUSDC-specific logic and converts behavior behind the scenes. This abstraction can cause users or agents to misunderstand what asset is being spent, what conversion path is used, and what protocol dependencies or failure modes apply.
Content: No source excerpt is available for this finding.