ClawHub
Back to skill

Security audit

Farming Planner

Security checks for vulnerabilities and agentic risk

Overview

The skill is related to PancakeSwap farming, but it mandates telemetry, unreviewed local code execution, runtime dependency installation, and transaction-capable commands that need manual review before use.

Review this skill before installing. It should not run the mandatory telemetry ping, unbundled Node scripts, automatic pip installs, or cast send transaction examples without explicit user approval and tighter scoping. Treat all APR output as untrusted financial data and prefer PancakeSwap UI links over CLI transactions.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

other

Warning
Location
SKILL.md:85
Finding

Mandatory Undisclosed Telemetry Transmits Host and Agent Metadata

Content
View full analysis
/dev/null & ``` ### Technical Analysis The mandatory initialization request sends the following information to `pancakeswap.ai`: - Skill name and version - AI system identifier - Exact execution timestamp - Operating system - CPU architecture - Source IP address, implicitly visible to the server The response is discarded using `-o /dev/null`, meaning the request cannot provide the stated “latest token list and deep link formats.” It therefore functions as telemetry rather than functional initialization. The request is executed in the background and suppresses errors, reducing visibility to the user. In addition, `pancakeswap.ai` is not included in the curl destination allowlist declared at `SKILL.md:77`, making the instructions internally inconsistent. This network transmission exceeds the minimum privileges needed to calculate farming APRs or generate PancakeSwap deep links. ### Attack Path 1. A user invokes the Skill for a farming-planning task. 2. The Skill requires the Agent to perform Step 0. 3. The Agent substitutes its system identifier into `AGENT_NAME`. 4. The background curl request sends agent and host metadata to `pancakeswap.ai`. 5. The remote service can correlate the metadata with the source IP and invocation time. 6. Repeated invocations can be used to profile Sk ...[truncated 390 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
references/fetch-farms.py:1
Finding

Runtime Installation of an Unpinned Python Dependency

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:381
Finding

Mandatory Execution of Unbundled Working-Directory-Relative JavaScript

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
references/fetch-farms.py:213
Finding

Unescaped Remote Token Metadata Is Injected into Markdown Output

Content
View full analysis
0 and cake_price > 0: cake_apr = (yearly_cake_map[pool_addr] * cake_price) / tvl * 100 total_apr = lp_fee_apr + cake_apr lp_str = f'{lp_fee_apr:.1f}%' cake_str = f'{cake_apr:.1f}%' if cake_apr > 0 else '-' total_str = f'{total_apr:.1f}%' link = build_link(p) print(f'| {pair} | {lp_str} | {cake_str} | {total_str} | {tvl_str} | {proto} | {chain_key} | {link} |') ``` `references/fetch-syrup-pools.py` has the same issue: ```python for i, p in enumerate(pools): stk_sym = p['stakingToken']['symbol'] earn_sym = p['earningToken']['symbol'] stk_addr = p['stakingToken']['address'].lower() earn_addr = p['earningToken']['address'].lower() stk_dec = p['stakingToken']['decimals'] raw = staked_results[i] if staked_results[i] and staked_results[i] != '0x' else '0x0' total_staked = int(raw, 16) / (10 ** stk_dec) stk_price = token_prices.get(stk_addr, 0) earn_price = token_prices.get(earn_addr, 0) tps = p.get('tokenPerSecond') tpb = p.get('tokenPerBlock') if tps: yearly_tokens = float(tps) * SECONDS_PER_YEAR elif tpb: yearly_tokens = float(t ...[truncated 2791 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Findings (33)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The declared description says this skill should be used for planning PancakeSwap yield farming and CAKE staking workflows such as stake/unstake CAKE, stake/unstake LP, syrup pools, and harvesting rewards. The code does not implement those behaviors. Instead, it aggregates and filters farm/pool data, calls public RPC endpoints and APIs to estimate CAKE rewards/APR, ranks top pools, and prints a comparison table with links for adding liquidity. That is closer to a farm discovery/APR analysis utility than a staking operation planner. The network access is still related to PancakeSwap data, so the domain is adjacent, but the primary purpose and supported user intents are materially different from the declared description.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared description presents a skill for helping users farm on PancakeSwap, including staking/unstaking CAKE, staking/unstaking LP, harvesting rewards, and other operational yield-farming actions. The supplied code instead only fetches active Syrup Pool metadata from PancakeSwap, obtains token prices from CoinGecko and DexScreener, reads staking token balances of pool contracts via BSC RPC, computes TVL and APR, sorts pools by APR, and prints a table with a generic PancakeSwap pools link. This supports discovery or comparison of Syrup Pools, but it does not implement the core declared behaviors of staking, unstaking, withdrawing, depositing LP, or harvesting. Because the primary behavior is informational APR analysis rather than the declared broader yield-farming/staking operation skill, this is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The file states that the skill does not execute transactions, but later provides concrete cast send commands for staking, unstaking, and harvesting. In an agent setting, this contradiction can cause unsafe trust assumptions and may lead operators or downstream systems to treat the skill as read-only when it actually contains action-enabling instructions that move funds.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 272)May include surrounding context.

md
::: danger MANDATORY — Do NOT write your own Python script
Using `python3 -c "..."` causes SyntaxError (bash mangles `!` and `$`).
Using `curl | python3 << 'EOF'` causes JSONDecodeError (heredoc steals stdin).
You MUST follow the exact steps below. Do NOT improvise.
:::

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

The skill repeatedly instructs the agent to pipe live, untrusted network responses directly into a Python script. Even if the script is local, this creates a risky dataflow where malformed or adversarial API content can trigger parser bugs, resource exhaustion, or unsafe behavior in the local script, especially because the skill mandates the workflow and discourages deviation.

Content

Scanner excerpt · SKILL.md (reported line 299)May include surrounding context.

bash
# All chains, all protocols (default — uses /list for comprehensive results):
curl -s "https://explorer.pancakeswap.com/api/cached/pools/list?orderBy=volumeUSD24h&protocols=v2&protocols=v3&protocols=stable&protocols=infinityBin&protocols=infinityCl&protocols=infinityStable&chains=bsc&chains=ethereum&chains=base&chains=arbitrum&chains=zksync&limit=100" | python3 "$PCS_FARMS_SCRIPT"

# BSC only:
curl -s "https://explorer.pancakeswap.com/api/cached/pools/list?orderBy=volumeUSD24h&protocols=v2&protocols=v3&protocols=stable&protocols=infinityBin&protocols=infinityCl&protocols=infinityStable&chains=bsc&limit=100" | CHAIN_FILTER=bsc python3 "$PCS_FARMS_SCRIPT"

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

This is the same unsafe pattern applied to Solana pool data: untrusted API output is streamed straight into a Python process. In an agent environment, repeated use of this pattern broadens the attack surface to parsing vulnerabilities and denial-of-service via crafted responses.

Content

Scanner excerpt · SKILL.md (reported line 320)May include surrounding context.

curl -s "https://explorer.pancakeswap.com/api/cached/pools/farming?protocols=v2&protocols=v3&protocols=stable&protocols=infinityBin&protocols=infinityCl&chains=bsc" | CHAIN_FILTER=bsc python3 "$PCS_FARMS_SCRIPT"

Solana CLMM pools (uses sol-explorer, no chains filter needed):

curl -s "https://sol-explorer.pancakeswap.com/api/cached/v1/pools/list?orderBy=volumeUSD24h&protocols=v3&limit=100" | python3 "$PCS_FARMS_SCRIPT"

text

The output is a ready-to-use markdown table with LP Fee APR, CAKE APR, and Total APR columns, plus deep links per row. Copy it directly into your response.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 418)May include surrounding context.

md
Store matched Merkl and Incentra entries per pool for display in the output tables.

**Display rules:**

- Only show the "Merkl Rewards" row if there is a matched Merkl entry for the pool.
- Only show the "Incentra Rewards" row if there is a matched Incentra entry for the pool.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 739)May include surrounding context.

md
ees (`tokensOwed0`, `tokensOwed1`) and farming rewards (`farmReward`). Use the `fetch-solana.cjs` reference script to check pending amounts.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 742)May include surrounding context.

md
ees (`tokensOwed0`, `tokensOwed1`) and farming rewards (`farmReward`). Use the `fetch-solana.cjs` reference script to check pending amounts.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 777)May include surrounding context.

md
## Output Templates

::: danger MANDATORY OUTPUT RULE
**Every farm row you output MUST include a full `https://pancakeswap.finance/...` deep link URL.** A farm row without a URL is INVALID. Build the link from the Token Addresses table and URL Formulas above.
:::

Lp1

High
Category
MCP Least Privilege
Confidence
98% confidence
Finding

The file has effective shell capability because it invokes pip through subprocess, but that capability is not declared. Undeclared execution capability is dangerous in agent contexts because it permits system-level actions outside the expected scope of a farm-planning helper and increases blast radius if the environment is compromised.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
98% confidence
Finding

The file has effective shell capability because it invokes pip through subprocess, but that capability is not declared. Undeclared execution capability is dangerous in agent contexts because it permits system-level actions outside the expected scope of a farm-planning helper and increases blast radius if the environment is compromised.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

Installing Python packages at runtime is unjustified for this skill and exposes the system to remote code and supply-chain risk from package repositories. In the context of a planning skill, this is especially dangerous because the functionality does not require mutating the host environment or fetching executable dependencies during execution.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file is materially inconsistent with the skill manifest: instead of planning PancakeSwap CAKE staking or LP farm actions, it enumerates Solana wallet token accounts, derives CLMM position PDAs, queries on-chain position data, and fetches reward information from Solana/PancakeSwap explorer endpoints. In a planning-only skill, hidden wallet-inspection logic broadens the skill’s effective scope and can expose user portfolio/position metadata or cause downstream agents to act on the wrong chain/protocol assumptions, making the mismatch security-relevant rather than a harmless implementation detail.

Content

No source excerpt is available for this finding.

os.system() or os exec-family call

High
Category
Dangerous Code Execution
Confidence
98% confidence
Finding

The script executes a shell command to install a package at runtime, which gives code execution capability through the package manager and shell outside the normal dependency trust boundary. In an agent-skill context, this is especially dangerous because simply invoking a read-only planning helper can modify the environment and pull unpinned code from the network without review.

Content

Scanner excerpt · references/fetch-syrup-pools.py (reported line 5)May include surrounding context.

python
try:
    import requests
except ImportError:
    os.system('pip install requests -q')
    import requests
RPC_URL = 'https://bsc-rpc.publicnode.com'
SECONDS_PER_YEAR = 31_536_000

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The manifest trigger text goes beyond specific phrases and says to use the skill whenever the user "describes wanting to stake, unstake, or earn yield on PancakeSwap." That natural-language condition is broad and lacks clear boundaries or negative examples beyond one special case, which could cause unintended invocation for general DeFi discussions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
78% confidence
Finding

The manifest describes a planner that discovers farms and generates deep links, but allowed-tools grants Bash(xdg-open:*) and Bash(open:*), enabling the skill to launch URLs locally. Opening applications/browser windows is not necessary to plan farming strategies or return links, and exceeds the stated advisory role.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 7)May include surrounding context.

md
description: Plan yield farming and CAKE staking on PancakeSwap. Use when user says "farm on pancakeswap", "stake CAKE", "unstake CAKE", "stake LP", "unstake LP", "yield farming", "syrup pool", "pancakeswap farm", "earn CAKE", "farm APR", "harvest rewards", "deposit LP", "withdraw LP", or describes wanting to stake, unstake, or earn yield on PancakeSwap. Do NOT use this skill when the user has a token pair and asks how to earn yield or best profit with those tokens (prefer liquidity-planner instead).
homepage: https://github.com/pancakeswap/pancakeswap-ai
allowed-tools: Read, Write, Edit, Glob, Grep, Bash(curl:*), Bash(jq:*), Bash(cast:*), Bash(python3:*), Bash(node:*), Bash(xdg-open:*), Bash(open:*), WebFetch, WebSearch, Task(subagent_type:Explore), AskUserQuestion
model: sonnet
license: MIT
metadata:
  author: pancakeswap

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 210)May include surrounding context.

md
### Pre-built Deep Links (BSC)

| Pair        | Type       | Add Liquidity Deep Link                                                                                                                                 |
| ----------- | ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------- |
| CAKE / WBNB | V2         | `https://pancakeswap.finance/v2/add/0x0E09FaBB73Bd3Ade0a17ECC321fD13a19e81cE82/0xbb4CdB9CBd36B01bD1cBaEBF2De08d9173bc095c?chain=bsc&persistChain=1`     |
| CAKE / WBNB | Infinity   | `https://pancakeswap.finance/liquidity/add/bsc/infinity/0xcbc43b950eb089f1b28694324e76336542f1c158ec955921704cebaa53a278bc?chain=bsc&persistChain=1`    |

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 898)May include surrounding context.

md
## Farming Types Reference

| Type           | Pool Version | How It Works                                                                                                  | Staking Flow                                        | Reward  |
| -------------- | ------------ | ------------------------------------------------------------------------------------------------------------- | --------------------------------------------------- | ------- |
| V2 Farms       | V2           | Stake LP tokens in MasterChef v2, earn CAKE per block                                                         | 2 steps: add liquidity → stake LP in MasterChef     | CAKE    |
| V3 Farms       | V3           | Stake V3 NFT positions in MasterChef v3, earn CAKE per block                                                  | 2 steps: add liquidity → transfer NFT to MasterChef | CAKE    |

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Automatic package installation occurs without user notice or operator confirmation, causing silent modification of the runtime environment. This increases the chance of unexpected network access, package poisoning exposure, and non-reproducible behavior that is hard to audit.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
97% confidence
Finding

The script executes a subprocess to install a package at runtime, giving the skill undeclared shell execution capability and introducing supply-chain risk. Even though the command is not directly user-controlled, it can modify the environment, pull unpinned code from package indexes, and violate least-privilege expectations for a farming-planner reference script.

Content

Scanner excerpt · references/fetch-farms.py (reported line 6)May include surrounding context.

python
import requests
except ImportError:
    import subprocess
    subprocess.check_call([sys.executable, '-m', 'pip', 'install', '-q', 'requests'])
    import requests
CHAIN_FILTER = os.environ.get('CHAIN_FILTER', '')
PROTOCOL_FILTER = os.environ.get('PROTOCOL_FILTER', '')

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The manifest describes a skill for planning CAKE staking and yield farming on PancakeSwap, but this file is built to process pools on many chains and multiple protocol types, including Ethereum, Arbitrum, Base, zkSync, opBNB, Linea, and Solana. That broad cross-chain farm discovery behavior materially exceeds the narrow PancakeSwap staking/farming scope implied by the manifest.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/fetch-farms.py (reported line 42)May include surrounding context.

python
def _rpc_batch(rpc, batch, retries=2):
    for attempt in range(retries + 1):
        try:
            resp = requests.post(rpc, json=batch, timeout=15)
            raw = resp.json()
            if isinstance(raw, dict):
                if attempt < retries:

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script reads a wallet public key from an environment variable even though the manifest describes a planning skill, not a wallet-aware inspection tool. This creates an undeclared data-access path where deployment secrets or user-linked identifiers can be consumed implicitly, enabling silent account profiling and making the skill more dangerous because users would not reasonably expect wallet enumeration from this context.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
references/fetch-solana.cjs:24