T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/check-slippage.py:43- Finding
Wallet Address and Trade Intent Disclosed Through Quote URL
- Content
View full analysis
- Remediation
View remediation
Security audit
Pendle PT Fixed-Yield Strategy
Security checks for vulnerabilities and agentic risk
Overview
The skill is not destructive, but it gives financial strategy guidance using under-disclosed wallet-linked quote requests and weakly verified external market data.
Install only if you are comfortable with a financial research skill that calls live third-party DeFi APIs and stores local position data. Do not provide a real wallet address for quote previews unless you accept that Pendle may receive wallet-linked trade intent metadata. Treat 'verified' route labels and loop rankings as research leads, not execution approval, and independently verify protocol support, liquidity, borrow caps, slippage, and URLs before acting.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
scripts/scan-contango-pt-markets.py:12- Finding
Mutable Unpinned Contango Configuration Is Treated as Verified Financial Data
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/merge-loop-data.py:103- Finding
Hard-Coded User Confirmation Improperly Elevates a Market's Trust and Ranking
- Content
View full analysis
Morpho -> borrow USDC path from Pendle Pencosystem tab.') maybe_add('Contango', ['USDC'], confidence='ecosystem-live', notes='Contango listed in Pendle Pencosystem; verify exact market support in app before execution.') return out ``` The ranking logic grants this hard-coded status a high integration score: ```python def integration_score(integrations: list): if not integrations: return 0.0 if verified_integrations(integrations): return 0.95 confirmed = any(i.get('venueConfidence') == 'confirmed-by-user' for i in integrations) if confirmed: return 0.90 return 0.60 ``` ### Technical Analysis The source code embeds a claim that a particular market integration was “confirmed-by-user.” This assertion is applied to every user and every future run, even though the current user has not necessarily confirmed it. The assertion has no associated: - Identity or scope of the confirming user - Confirmation timestamp - Block number or chain-state reference - Source URL or verifiable evidence - Expiration period - Current market-support check - Borrow-cap, liquidity, collateral, or health validation Protocol integrations and collateral markets can change over time. A previously valid route can be disabled, deprecated, drained, capped, or otherwise become unsuitable. Despite this, the hard-coded branch bypasses ordinary heuristic p ...[truncated 2027 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (19)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The declared description presents a comprehensive Pendle PT strategy tool covering research, opportunity selection, monitoring existing positions, maturity awareness, and planning multiple action types with explicit wallet-path handling. The supplied code chunk is much narrower: it performs a read-only quote preview against the Pendle Convert API for a single USDC→PT conversion candidate and reports slippage and APY-related fields. While this is related to execution planning/research, it is only one small subset of the declared functionality. Because the primary behavior is materially narrower than the declared purpose and several major declared capabilities are absent, this is a description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description presents a broad Pendle PT strategy skill covering market scanning, ranking, position tracking, maturity monitoring, and execution planning with managed-wallet or manual transaction paths. The supplied code only formats already-ranked market data from a local JSON file into a Markdown brief. While the report content is related to Pendle PT market research and includes maturity-related display fields such as daysToExpiry, it does not itself scan markets, rank them from raw data, track positions, monitor active holdings, prepare deposits/redeems/withdrawals/rollovers, or interact with any wallet backend. This is a material scope reduction and a different primary purpose, so the description does not accurately represent what this code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The declared description presents a user-facing Pendle PT strategy skill that supports research plus position tracking, maturity monitoring, and execution planning with wallet-path disclosures and possible managed-wallet execution. The supplied code is much narrower and different in emphasis: it merges local data sources into a JSON file of 'loop candidates', infers integrations with Morpho/Euler/Contango, applies APY/liquidity heuristics, and outputs leverage/loopability assessments. While there is partial overlap with market scanning/ranking and identifying stable-ish PT opportunities, the code lacks the major declared capabilities around wallet handling, transaction preparation/execution paths, confirmations, and position monitoring. Therefore the description materially overstates and mischaracterizes the actual behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The declared description presents a broad Pendle PT strategy skill covering market research/ranking, position tracking, maturity monitoring, and transaction preparation with wallet-path handling. The supplied code is much narrower: it is a CLI report generator that loads a precomputed JSON file and prints summaries of loop-ranked market candidates. While it loosely aligns with market ranking/research in the Pendle PT domain, its primary purpose is reporting on looping ideas, not the broader fixed-yield strategy lifecycle described. Key declared behaviors—wallet execution paths, explicit confirmations, transaction preparation, redeem/withdraw/rollover planning, and active position monitoring—are absent. Therefore the description materially overstates and mischaracterizes the code's actual behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description presents a full Pendle PT strategy skill that can research opportunities, monitor positions and maturities, and prepare or potentially execute actions through a managed wallet or manual path. The supplied code chunk is much narrower: it only loads a local JSON file of already-ranked markets and prints a text report segmented by fit/verdict categories. While this supports the 'market scanning/ranking report' aspect at a presentation level, it lacks the major described capabilities around wallet-backed execution, transaction preparation, user confirmation flows, position tracking, and monitoring. Therefore the description materially overstates what this code chunk actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The declared description presents a broad Pendle PT strategy tool covering research, market selection, active monitoring, and execution-path-aware action preparation. The supplied code does only one narrow subset: local position status reporting from data/positions.json. It does not scan markets, rank opportunities, interact with wallets, prepare transactions, or support execution flows. While position tracking/status reporting is consistent with part of the description, the primary behavior of this code chunk is materially narrower than the declared purpose, so this is a description-behavior mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a broad Pendle PT strategy skill covering market research, ranking, active position monitoring, maturity monitoring, and execution preparation with wallet-path disclosures. The supplied code is much narrower: it only filters pre-ranked Pendle PT market data and cross-references it against Contango's public integration config to verify supported PT routes. It does not track user positions, monitor maturities in any active sense, prepare execution actions, or interact with any wallet backend. Its primary purpose is external integration verification for Contango-supported Pendle PT markets, which is materially different from the broader declared operational and execution-focused behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description presents a broad Pendle PT strategy tool focused on market research, ranking, ongoing position/maturity monitoring, and preparation or execution of user actions via controlled wallet flows. The supplied code instead has a much narrower and different function: it cross-references ranked Pendle PT markets against Euler's live GraphQL tokenlist and vault data to verify Euler-related PT market support, then saves the results to disk. This Euler-specific verification behavior is undeclared, while several central declared capabilities—wallet path handling, transaction planning/execution, active position tracking, and maturity monitoring—are absent from the code. That makes the actual behavior materially different from the declared purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The declared description presents a broad Pendle PT strategy assistant that can scan/rank opportunities, monitor positions and maturities, and prepare user-confirmed execution flows such as deposit, redeem, withdraw, and rollover. The supplied code does only one narrow data-processing task: it filters input PT market records, queries Morpho's GraphQL endpoint for listed collateral markets, and saves the results. That is related to market research/scanning, but it does not implement the major described capabilities around position tracking, maturity monitoring, execution planning, or managed/manual wallet transaction pathways. Its primary purpose is better described as Morpho PT-collateral market verification/enrichment, so the description materially overstates and mischaracterizes the code chunk's behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description is about a Pendle PT investment/research workflow: evaluating PT opportunities, monitoring positions, handling maturity-related actions, and planning wallet-mediated execution. The supplied code does none of that. It only downloads the Pendle 'pencosystem' webpage, parses structured JSON for partner records, and saves ecosystem-partner metadata. This is a materially different primary purpose and resource target from PT strategy and execution planning, so the description does not accurately represent the code's behavior.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `SKILL.md` | Strategy instructions and safety rules |
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest describes a Pendle PT fixed-yield strategy focused on scanning, ranking, tracking, monitoring, and execution planning for Pendle PT positions. This script queries Morpho's GraphQL API and produces a dataset of Morpho PT-collateral lending markets, which is a distinct protocol-level capability not clearly described in the manifest's stated scope.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python DATA = HERE.parent / 'data' DEFAULT_PT_INPUT = DATA / 'ranked.latest.json' DEFAULT_OUT = DATA / 'morpho-pt-markets.latest.json' GRAPHQL_URL = 'https://api.morpho.org/graphql' def iso_now():
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest describes a Pendle PT fixed-yield strategy skill focused on market scanning, ranking, position tracking, maturity monitoring, and execution planning for PT positions. This script instead fetches the public Pendle '/pencosystem' page, extracts partner/protocol metadata, and writes a partner listing JSON file, which is a different ecosystem-directory collection task rather than PT opportunity analysis or execution planning.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
This JSON file defines strategy parameters but provides no explicit activation conditions, trigger phrases, or scope constraints for when the associated skill should run. For manifest/config files, the absence of invocation boundaries can make activation behavior ambiguous if this file is used as part of skill discovery or routing.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The header documentation says the script fetches current market data from the Pendle API for mark-to-market, and helper functions for that fetch exist. However, main() never calls fetch_market_data() or fetch_json(), so the runtime behavior is limited to local position-file analysis and reporting.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This code creates the output directory and writes JSON to the path provided by --out, defaulting to data/ranked.latest.json. Although the path is configurable, there is no confirmation prompt or explicit warning that the operation will overwrite an existing file, which is a file-write action with potential user data impact.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The manifest frames the skill around Pendle PT market scanning, ranking, position tracking, maturity monitoring, and execution planning. This script instead queries Euler's GraphQL indexer, correlates Pendle PTs against Euler tokenlists and vaults, and writes a separate Euler verification dataset, which expands behavior beyond the described Pendle-only scope.
- Content
Static analysis
No suspicious patterns detected.