Web3 Yield Automator PRO

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:55 AM UTC
• Version: 2.0.0

Overview

This paid DeFi automation skill makes strong financial automation claims, but the inspected code is only a local configuration stub and does not perform the advertised on-chain monitoring or fund management.

Review carefully before installing or paying. This artifact does not appear to steal keys or move funds, but it also does not deliver the advertised DeFi automation, has unclear financial-risk disclosure, stores wallet metadata locally, and has install/dependency reproducibility problems. Do not rely on it for portfolio protection, yield optimization, or automated exits unless the publisher provides reviewed implementation evidence and safer pinned installation instructions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:32
• Finding: Unpinned Global Package Installation Can Retrieve Unaudited Code<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:32-35` **Vulnerability Type**: Unpinned third-party package installation **Risk Level**: Medium ### Vulnerable Code ```bash ## Quick Start: npm install -g web3-yield-automator ``` ### Technical Analysis The documented installation command retrieves the current package associated with `web3-yield-automator` from the user's configured npm registry. It does not specify an exact version or verify an expected package digest. Consequently, the code installed by a user may differ from the artifact covered by this audit. A later release, compromised publisher account, registry substitution, or malicious registry configuration could cause the same documented command to retrieve altered code. The global installation scope also exposes the downloaded package as a system-wide command. Although the audited package does not declare an installation lifecycle script, future or substituted package versions are outside the guarantees of this review and could contain such scripts or malicious CLI behavior. ### Attack Path 1. A user trusts the installation instructions in `SKILL.md`. 2. The user runs `npm install -g web3-yield-automator`. 3. npm resolves the current package version through the configured registry rather than a specifically audited release. 4. An attacker who has compromised the package, publisher account, or registry response supplies a modified release. 5. npm installs the substituted package globally. 6. Malicious behavior can run through package lifecycle hooks, if introduced in the substituted release, or when the user invokes `yield-automator`. ### Impact Assessment A malicious substituted package could execute code with the privileges of the account running npm or the CLI. Depending on those privileges, the impact could include access to user files, environment variables, wallet-related material available to the process, network resources, and modification of globally installed comma ...[truncated 176 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin the installation command to an exact reviewed version, for example: ```bash npm install -g web3-yield-automator@1.0.0 ``` - Publish and document the expected package integrity digest or signed provenance. - Recommend installation with a lockfile in a dedicated project instead of global installation where practical. - Use npm provenance and protected publisher credentials with multi-factor authentication. - In release documentation, state the exact source commit and package digest corresponding to each published version. - Require a new security review whenever the published package contents or dependency graph changes. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: index.js:1
• Finding: Imported CLI Dependency Is Missing from the Manifest and Lockfile<![CDATA[ ## Vulnerability Details **File Location**: `index.js:1-7`, `package.json:17-21`, and `package-lock.json:8-14` **Vulnerability Type**: Undeclared runtime dependency **Risk Level**: Medium ### Vulnerable Code `index.js` imports `commander` during process startup: ```js #!/usr/bin/env node import { program } from 'commander'; import { ethers } from 'ethers'; import axios from 'axios'; import fs from 'fs'; import path from 'path'; import { fileURLToPath } from 'url'; ``` However, the package manifest declares only `ethers` and `axios`: ```json "dependencies": { "ethers": "^6.0.0", "axios": "^1.6.0" }, "engines": { "node": ">=18.0.0" } ``` The lockfile root contains the same incomplete dependency set: ```json "dependencies": { "axios": "^1.6.0", "ethers": "^6.0.0" }, "bin": { "yield-automator": "index.js" } ``` ### Technical Analysis ES module imports are resolved before command handling begins. Because `commander` is neither declared in `package.json` nor represented as a direct dependency in `package-lock.json`, a clean installation cannot reliably resolve the import. Under normal npm dependency isolation, invoking the CLI will fail with a module-resolution error unless an unrelated copy happens to be accessible from the environment. This undermines reproducibility and can encourage users or operators to install an arbitrary package manually to repair the application. Such ad hoc dependency installation bypasses the reviewed dependency graph and can expose users to the wrong package, an incompatible release, or an untrusted source. ### Attack Path 1. A user installs the package according to its documentation. 2. npm installs only the dependencies declared in the manifest and lockfile. 3. The user invokes the `yield-automator` command. 4. Node.js attempts to resolve the startup import of `commander`. 5. The CLI fails because the dependency is unavailable. 6. The user or an automated deployment process attempts to repair the failu ...[truncated 687 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Add `commander` as an explicit production dependency using a reviewed, compatible version. - Regenerate `package-lock.json` so the dependency and its exact resolved integrity metadata are recorded. - Prefer an exact dependency version where strict reproducibility is required. - Run `npm ci` in a clean environment and verify that every documented command starts successfully. - Add automated tests that invoke `init`, `config`, `start`, and `status` after a clean installation. - Do not instruct users to repair missing modules through arbitrary global installations. - Remove the unused `axios` dependency unless network functionality is actually implemented, thereby reducing the dependency attack surface. ]]>

other

Warning

• Location: index.js:58
• Finding: Advertised Financial Automation and Safety Controls Are Not Implemented<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:13-29` and `index.js:58-71` **Vulnerability Type**: Misleading financial functionality **Risk Level**: Medium ### Vulnerable Code The Skill documentation advertises active financial automation: ```markdown ## What it does: - 🚀 **Auto-compounds** rewards on Aave, Compound, Lido, RocketPool - 🔄 **Rebalances** funds to highest APY opportunities in real-time - ⛓️ **Cross-chain** yield farming (Ethereum, Polygon, Arbitrum, Optimism, Base) - 💰 **Maximizes returns** by 15-40% vs manual claiming - 🛡️ **Risk management** - auto-exits if APY drops below threshold ## Premium Features: 1. **Smart Contract Integration** - Direct on-chain execution 2. **Multi-wallet Support** - Manage unlimited wallets 3. **Real-time Dashboard** - Track yields across all chains 4. **Auto-Compound Strategies** - Custom strategies per protocol 5. **Tax Optimization** - Harvest losses, delay gains ``` The corresponding `start` command is explicitly a stub and only prints messages: ```js program.command('start') .description('Start yield automation') .action(async () => { loadConfig(); console.log('🚀 Starting Web3 Yield Automator...'); console.log('📊 Monitoring chains:', config.chains); console.log('🎯 Min APY:', config.minApy + '%'); console.log('⚠️ Risk profile:', config.risk); // Stub for actual DeFi automation logic console.log('\n💡 Premium features unlocked:'); console.log(' - Auto-compound rewards'); console.log(' - Cross-chain rebalancing'); console.log(' - Tax optimization'); console.log('\n⚡ Full automation logic deployed on purchase.'); }); ``` ### Technical Analysis The implementation does not instantiate a blockchain provider, signer, smart-contract client, monitoring loop, pricing or yield data source, or transaction workflow. No API request is issued, and no on-chain transaction is created or submitted. The `start` command nevertheless emits su ...[truncated 1677 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove all claims of active automation, smart-contract execution, risk exits, dashboards, and tax optimization until those features are implemented and independently tested. - Clearly identify the current package as a nonfunctional prototype or configuration demonstration. - Replace success-like output with an explicit warning that no monitoring or financial action is occurring. - Align the documented command syntax with the implemented CLI. - If automation is implemented later: - Use explicit user authorization for every signing capability. - Never request seed phrases or raw private keys. - Use narrowly scoped wallet permissions and transaction limits. - Display transaction simulations, destinations, amounts, slippage, fees, and chain IDs before authorization. - Implement fail-safe monitoring, audit logs, rate limits, allowlisted contracts, and emergency shutdown controls. - Add integration tests against forked networks and obtain a smart-contract security review. - Substantiate financial performance claims with transparent methodology and appropriate risk disclosures. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The skill markets itself as a premium autonomous DeFi yield optimizer, but the described setup and observed behavior do not substantiate the claimed on-chain automation, rebalancing, or APY-driven fund movement. In a financial/web3 context, this mismatch is dangerous because users may pay for the product, make risk decisions, or expose wallets under false assumptions about what the software actually does.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill advertises autonomous on-chain execution and multi-wallet management without prominent warnings about transaction authority, custody risk, bridge/protocol risk, liquidation or slippage risk, and the consequences of automated fund movement. In the DeFi context, omission of these warnings materially increases the chance that users will grant trust or permissions without understanding that losses can occur rapidly across multiple chains and wallets.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill’s metadata and runtime output market automated DeFi yield farming, cross-chain rebalancing, and premium automation, but the implementation only prints placeholder messages and performs no actual automation. In a financial/web3 context, this is dangerous because users may rely on false capabilities, make asset-management decisions based on misleading claims, or be socially engineered into a future paid upgrade or follow-on component that requests wallet access.

Known Vulnerable Dependency: axios==1.16.0 — 10 advisory(ies): CVE-2026-67313 (Axios: Excessive recursion in formDataToJSON can cause denial of service); CVE-2026-67319 (Axios: Nested axios option objects can consume polluted prototype values); CVE-2026-67315 (Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios) +7 more

High

• Category: Supply Chain
• Confidence: 96% confidence
• Finding: The lockfile pins axios to 1.16.0, which the provided analysis reports as affected by multiple HIGH-severity advisories including denial of service, prototype-pollution-adjacent behavior, and proxy bypass issues. In a DeFi automation skill that likely makes frequent outbound RPC/API requests and may process untrusted response or config data, these flaws can increase exposure to service disruption, request-routing abuse, or unsafe handling of attacker-controlled inputs.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 91% confidence
• Finding: form-data 4.0.5 is reported vulnerable to CRLF injection via unescaped multipart field names/filenames. If this skill ever constructs multipart requests from user-controlled or external data, an attacker may be able to smuggle crafted headers or alter request structure, which is especially risky when interacting with third-party APIs or signing/upload workflows.

Known Vulnerable Dependency: ws==8.17.1 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 93% confidence
• Finding: ws 8.17.1 is flagged for memory disclosure and memory-exhaustion denial of service. Because ethers commonly uses WebSocket providers for blockchain event streams and this skill is designed for automated multi-chain yield operations, a vulnerable WebSocket stack could expose sensitive process memory or allow remote peers to destabilize long-running automation by exhausting resources.

Known Vulnerable Dependency: axios==1.16.0 — 10 advisory(ies): CVE-2026-67313 (Axios: Excessive recursion in formDataToJSON can cause denial of service); CVE-2026-67319 (Axios: Nested axios option objects can consume polluted prototype values); CVE-2026-67315 (Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios) +7 more

High

• Category: Supply Chain
• Confidence: 96% confidence
• Finding: The file includes axios at a version identified by the scanner as having multiple known advisories, including denial-of-service and proxy-handling issues. In a cross-chain DeFi automation context that likely depends on external APIs and network routing, vulnerable HTTP behavior can disrupt automation, expose internal network assumptions, or amplify the impact of malicious responses.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The `init` command claims to operate in 'read-only mode' but persists wallet addresses to `config.json`, which is a state-changing action involving sensitive financial metadata. While wallet addresses are public on-chain, silently storing them locally under a misleading 'read-only' label can violate user expectations, expose portfolio associations on shared systems, and erode trust in a tool already positioned for DeFi automation.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"license": "PROPRIETARY",
  "private": false,
  "dependencies": {
    "ethers": "^6.0.0",
    "axios": "^1.6.0"
  },
  "engines": {

• Confidence: 87% confidence
• Finding: The dependency is version-ranged with a caret, which allows automatic installation of newer minor/patch releases that may change behavior or introduce malicious or vulnerable code through the supply chain. In a DeFi automation tool that can potentially handle wallets, RPC interactions, and fund movement, dependency drift increases the risk of compromise and makes builds non-reproducible.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"private": false,
  "dependencies": {
    "ethers": "^6.0.0",
    "axios": "^1.6.0"
  },
  "engines": {
    "node": ">=18.0.0"

• Confidence: 90% confidence
• Finding: Using a caret range for axios permits unreviewed dependency updates, which is a supply-chain risk and can unexpectedly pull in vulnerable releases. Because this package is a publicly installable DeFi automation skill, any compromised or flawed HTTP client dependency could affect remote data fetching, transaction logic, or secrets handling.

Static analysis

No suspicious patterns detected.