Pendle PT Research

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:38 AM UTC
• Version: 1.0.0

Overview

This is a disclosed DeFi research skill that fetches public market data and writes local reports, but its bundled leveraged-route rankings should be refreshed and independently verified before use.

Install only if you want an advisory DeFi research helper. Before relying on any output, rerun the live scanners, check market liquidity and borrow depth yourself, and do not let the skill or its bundled data drive wallet transactions automatically.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

If the underlying implementation actually performs website scraping/extraction and local file writing unrelated to the declared research purpose, that is a meaningful trust-boundary problem. A skill that claims to analyze PT opportunities but instead harvests external metadata and writes it locally can cause users or orchestrators to grant network and filesystem access under false pretenses, which is dangerous in an agent setting.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 86% confidence

Finding

If the underlying implementation actually performs website scraping/extraction and local file writing unrelated to the declared research purpose, that is a meaningful trust-boundary problem. A skill that claims to analyze PT opportunities but instead harvests external metadata and writes it locally can cause users or orchestrators to grant network and filesystem access under false pretenses, which is dangerous in an agent setting.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

If the underlying implementation actually performs website scraping/extraction and local file writing unrelated to the declared research purpose, that is a meaningful trust-boundary problem. A skill that claims to analyze PT opportunities but instead harvests external metadata and writes it locally can cause users or orchestrators to grant network and filesystem access under false pretenses, which is dangerous in an agent setting.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises and instructs use of scripts that read local files, write JSON outputs, and fetch live network data, but it declares no explicit tool scope or permission boundaries. In an agent environment, this broad implicit capability increases the chance of unintended file access, data exfiltration, or unexpected external calls because neither the platform nor the user gets a constrained execution contract.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The looping instructions describe a leveraged strategy pattern but provide no trigger constraints, risk boundaries, eligibility checks, or requirement for fresh verification. In this skill context, that is more dangerous because the domain is financial strategy research and an agent may operationalize these routes into actionable guidance despite stale data, unsupported markets, or unsuitable user risk profiles.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The dataset marks a route as the "bestVerifiedRoute" even though the selected market shows effectively no usable liquidity (about $10 supplied, $0 borrowed, 0 utilization). An agent consuming this file could present or prioritize an execution path that is not practically executable, causing misleading recommendations and potentially prompting failed or harmful user actions in live DeFi markets.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The repeated integration and route guidance appears broadly across multiple entries and implies general availability of leverage paths without clear scope limits for each specific PT market. Because many entries are marked heuristic or ecosystem-live rather than truly verified, an agent may overgeneralize and recommend unsupported or unsafe strategies at scale.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/scan-morpho-pt-markets.py (reported line 12)May include surrounding context.

python

DATA = HERE.parent / 'data'
DEFAULT_PT_INPUT = DATA / 'ranked.latest.json'
DEFAULT_OUT = DATA / 'morpho-pt-markets.latest.json'
GRAPHQL_URL = 'https://api.morpho.org/graphql'


def iso_now():

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest describes a skill focused on researching Pendle PT markets, loopability, collateral support, and PT opportunity comparison. This file instead fetches the generic Pendle ecosystem webpage, extracts partner/protocol metadata such as Contango and other integrations, and saves it as a local JSON file; that is adjacent ecosystem discovery, not PT-market analysis itself.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This research file goes beyond descriptive market data and includes prescriptive execution guidance such as manual and automated routes. In an agent skill, that increases the chance the model treats the dataset as instruction-bearing content and recommends concrete leveraged actions without additional policy checks or user confirmation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This JSON file contains natural-language instructional fields such as "manualRoute" and "automationRoute" that hard-code English phrasing for user-facing workflow guidance. Because the file provides no indication that language choice is configurable or intentionally region-specific, it creates a mild language-policy concern under the locale-choice rule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This JSON includes user-facing token labels such as "USD₮0" in ptName and assetRepresentation, which use a stylized glyph variant instead of a standard ticker spelling. In a skill context, forcing a locale- or script-specific rendering without explanation or user opt-in can create confusion and may violate language/locale consistency expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 73% confidence

Finding

The file uses the literal value "Unknown" for assetRepresentation in market entries, which is a user-facing natural-language label rather than a neutral null or omitted field. Presenting fallback language without documented behavior can create ambiguous locale/content handling and inconsistent user experience.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This JSON includes a Coinbase partner URL hard-coded to the en-gb locale, which imposes a specific language/region variant without any indication of user opt-in or region-specific justification. Under the policy rule for natural-language locale constraints, fixed locale selection can be a policy concern when no choice is offered.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.