ClawHub
Back to skill

Security audit

FarmDash Autonomous Operator

Security checks for vulnerabilities and agentic risk

Overview

The skill is a high-impact DeFi automation connector, but its artifacts clearly disclose the financial execution boundaries, approval gates, revocation paths, and zero-custody design.

Install only if you intend to let an agent coordinate DeFi workflows. Keep grant scopes, budgets, allowlists, and expiry windows tight; use USER_SIGNED execution unless you have deliberately approved a bounded grant; never provide private keys, seed phrases, or RPC credentials to the skill.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 253)May include surrounding context.

md
**Why FarmDash:** Unlike 'autonomous' agents that hold keys, a FarmDash session token alone is not execution authority — actions move only under a scoped, time-limited, revocable EIP-712 grant, or a fresh user signature.

<!-- farmdash-canonical-links:start -->

## Official FarmDash Links

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest frames the skill as a bounded, preview-gated autonomous operator, but it also exposes hire_virtuals_specialist, which introduces ACP tendering and escrow-adjacent orchestration outside that stated scope. This scope expansion increases the chance that a caller grants trust, tokens, or approvals under the assumption of autopilot-only behavior, creating a confused-deputy and social-engineering risk even if the tool claims customer-local signing.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill advertises bounded session-based autopilot, but also includes MEE cross-chain intent creation, simulation, and submission flows. Cross-chain execution materially broadens authority and operational risk; embedding it in an autopilot-branded skill can cause downstream agents or users to misjudge what actions are available and approve workflows they would otherwise isolate.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.json (reported line 1953)May include surrounding context.

json
- [FarmDash autonomous DeFi agent platform](https://www.farmdash.one/agents)
- [FarmDash DeFi intelligence homepage](https://www.farmdash.one/)
- [Canonical Autonomous Operator skill manual](https://www.farmdash.one/openclaw-skills/farmdash-autonomous-operator/SKILL.md)

**Companion skills:** FarmDash Trail Marshal, FarmDash Signal Architect, FarmDash Futures Strategist, FarmDash Trail Intelligence, FarmDash Wagon Steward.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 247)May include surrounding context.

md
- [FarmDash autonomous DeFi agent platform](https://www.farmdash.one/agents)
- [FarmDash DeFi intelligence homepage](https://www.farmdash.one/)
- [Canonical Autonomous Operator skill manual](https://www.farmdash.one/openclaw-skills/farmdash-autonomous-operator/SKILL.md)

**Companion skills:** FarmDash Trail Marshal, FarmDash Signal Architect, FarmDash Futures Strategist, FarmDash Trail Intelligence, FarmDash Wagon Steward.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 259)May include surrounding context.

md
- [FarmDash autonomous DeFi agent platform](https://www.farmdash.one/agents)
- [FarmDash DeFi intelligence homepage](https://www.farmdash.one/)
- [Canonical Autonomous Operator skill manual](https://www.farmdash.one/openclaw-skills/farmdash-autonomous-operator/SKILL.md)

**Companion skills:** FarmDash Trail Marshal, FarmDash Signal Architect, FarmDash Futures Strategist, FarmDash Trail Intelligence, FarmDash Wagon Steward.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The 'Session-Profit Grant Hygiene' guidance tells the agent to use grant_session_key, session_key_status, and execute_cycle_actions, but the main tool documentation above primarily describes different session and execution interfaces such as request_execution_delegation, register_execution_delegation, and autopilot_cycle. This is an active documentation inconsistency that can misstate which operations actually implement the described safety flow.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.