Security audit

XPR Lending (LOAN Protocol)

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent DeFi lending skill, but it can sign mainnet financial transactions using a local private key that is not declared in the install metadata.

Review this before installing as a mainnet financial tool. Only provide XPR_PRIVATE_KEY/XPR_ACCOUNT in an environment where you trust the agent to request explicit approval before setting confirmed=true, and prefer a limited blockchain permission rather than a broad active key when possible. Be aware that account lookups and market stats use external RPC/API services.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill description understates actual behavior: it presents itself as interacting with the lending.loan contract, but the content indicates signed write operations, token transfers, use of external Metal X API endpoints, and interactions with additional contracts/tokens. This mismatch is dangerous because users or orchestrators may treat the skill as narrower and safer than it is, leading to approval of fund-moving actions or external data dependencies they did not intend to authorize.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill exposes network- and environment-capable behavior but does not declare any explicit tool scope, permissions, or allowed-tools boundaries. This is dangerous because callers and reviewers cannot reliably tell which external systems the skill may reach or whether it can trigger sensitive actions, increasing the chance of unintended signed transactions or data exfiltration through undeclared capabilities.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file-level documentation says this is a quick integration test for 'lending skill read-only tools' and specifically claims it 'Calls mainnet lending.loan directly.' However, tests 8-10 fetch APY/TVL data from https://identity.api.prod.metalx.com rather than directly from the lending.loan contract, expanding behavior beyond the stated direct-contract scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The tool sends a user-supplied account identifier to a third-party mainnet RPC endpoint to query positions, but the operation site does not clearly disclose that the identifier is being transmitted off-platform. While account names on public blockchains are often public, this still creates a privacy and metadata leakage issue because it links a user request and account interest to a specific remote service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This reward lookup similarly transmits an account identifier to a remote RPC endpoint without prominent disclosure at the point of use. The data being queried is blockchain-public, but the undisclosed transmission can still leak user intent and create correlatable access logs at the external provider.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The TVL formatter hardcodes the 'en-US' locale for numeric rendering, which imposes a specific locale in output regardless of user preference. This is a natural-language/locale policy issue because the skill does not offer localization choice or explain why U.S. formatting is required.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: src/index.ts:108