Security audit

FarmDash Wagon Steward

Security checks across malware telemetry and agentic risk

Overview

This skill is mainly a disclosed read-only wallet analytics integration, with an optional consent-gated FarmDash onboarding call users should treat as telemetry/registration.

Install only if you are comfortable sending wallet addresses and optional API credentials to FarmDash for portfolio analysis. Do not run the optional onboarding POST unless you intentionally want FarmDash to register your public agent/wallet address and skill identifier for tier/capability and telemetry purposes.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill repeatedly asserts it is strictly read-only and only sends limited wallet-related fields, but later defines an optional POST onboarding flow that registers an agent address for analytics. Even though it is non-state-changing on-chain, it is still a write operation to a third-party service and expands data sharing beyond what earlier sections imply, which can mislead operators and orchestrators about privacy and side effects.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The onboarding/telemetry registration is not necessary to perform the stated function of read-only portfolio analytics, yet it introduces external data disclosure and persistent registration of an address. Unnecessary collection and registration increase privacy risk and create room for accidental or policy-violating execution by agents that may treat documented commands as supported setup steps.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: Earlier documentation says only the public wallet address, optional chain IDs, and bearer token are sent, and that no other fields are collected by skill logic. Later sections add transmission of an agent address, skill identifier, and analytics registration behavior, so the data disclosure statement is materially incomplete and could cause users to consent under false assumptions.

Vague Triggers

Low

Confidence: 74% confidence
Finding: Although the section says consent is required, the phrasing around when the setup check 'can be queried manually' and inclusion of a ready-to-run curl command may still encourage agents or operators to treat it as a normal initialization step. Ambiguous invocation guidance is risky in agentic environments because setup snippets are often automated or copied verbatim without re-evaluating consent requirements.

Missing User Warnings

Low

Confidence: 78% confidence
Finding: The upgrade/setup guidance near the end encourages further onboarding actions and browsing capabilities without repeating the privacy consequences of the analytics registration flow. In practice, users may follow adjacent setup prompts and disclose identifying data to a third party without seeing a nearby warning, which weakens informed consent.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.