31Third Safe Rebalancer (Simple)

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:22 PM UTC
• Version: 0.2.0

Overview

The skill appears purpose-aligned, but it can immediately execute real on-chain rebalancing with a private key and its install metadata is not reproducible enough for a financial automation tool.

Review before installing. Use only a least-privilege executor wallet, keep the Safe owner key out of this tool, store secrets outside committed files, run verify-deployment before rebalance_now, and test with minimal value first. Regenerate and review the lockfile from the current package.json, prefer npm ci, and pin maintainer CLI tooling before relying on this package in a production financial workflow.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: package.json:15

Finding

Non-Reproducible Dependencies and Unpinned Package Execution

Content

View full analysis

Remediation

View remediation

login", "clawhub:publish": "npx --yes clawhub@ publish ./ ..." ``` 7. Prefer adding the ClawHub CLI as an exact-version development dependency so its version and integrity are recorded in `package-lock.json`. 8. Run publishing operations from an isolated, minimally privileged environment with short-lived credentials. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (38)

Known Vulnerable Dependency: vitest==2.1.9 — 2 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed); CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Critical

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: vitest==2.1.9 — 2 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed); CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock)

Critical

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The declared description suggests a single-purpose rebalancer. While the code does support a rebalance-now operation, it also exposes a separate verify-deployment command that ingests troubleshooting data, optionally reads a local file, and calls verify_deployment_config. That is a materially different capability from simple one-step rebalancing and is not mentioned in the description. The code therefore has undeclared behavior and resource access (local file reading), making the description incomplete/inaccurate.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says this is a 'one-step Safe rebalancer,' implying operational portfolio rebalancing through Safe/executor flows. The code does not rebalance assets, submit transactions, or trigger policy-driven execution. Instead, it is a verification utility that fetches on-chain configuration from an executor module and related policy/oracle contracts, parses a provided troubleshooting summary, compares values against env and chain state, and returns checks, mismatches, and warnings. That is a materially different primary purpose from rebalancing, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description suggests the skill's purpose is to perform a one-step safe rebalance on-chain. However, the supplied code does not implement rebalancing logic itself; it is a test file for CLI behavior. It covers not only rebalance-now invocation but also a separate verify-deployment command, usage/error handling, filesystem reads, and security validation for file paths and JSON payloads. Those behaviors are broader and materially different from the narrowly declared purpose of a one-step safe rebalancer.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description says the skill is a one-step Safe rebalancer using on-chain policies, which implies executing or orchestrating asset rebalancing actions. However, the supplied code chunk does not rebalance assets, interact with Safe execution flows, or apply policies to perform trades. Instead, it defines unit tests for a configuration verification function that checks consistency between a deployment summary and mocked on-chain deployment data, including cooldowns, policy addresses, allocations, and slippage settings. This is a materially different primary purpose from rebalancing, so the description does not accurately represent the actual behavior of this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The description focuses narrowly on a one-step Safe rebalancer, but the code exposes an additional primary command, verify-deployment, which is a distinct capability from rebalancing. That verification flow also reads troubleshooting data from a local file and accepts deployment-related parameters like rpcUrl and executorModuleAddress, none of which are reflected in the declared purpose or permissions. While argument validation and CLI plumbing are supporting details, the deployment-verification function is a materially different purpose and the filesystem access is an undeclared resource access, so this is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The description says this skill is a 'One-step Safe rebalancer using on-chain 31Third policies,' which implies operational portfolio rebalancing. The supplied code does not rebalance assets, submit transactions, or interact with a Safe to execute trades. Instead, it verifies whether deployment/configuration data from env variables and a troubleshooting summary matches on-chain contract state for executor modules and policies. This is a materially different primary purpose, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents the skill as a one-step Safe rebalancer. The supplied code chunk does not implement rebalancing logic itself; it tests a CLI wrapper around mocked functions. In addition to a rebalance command, it supports a separate verify-deployment command and accepts troubleshooting data from either command-line input or a local file, including path traversal checks. Those behaviors are materially broader and different from the declared purpose. While some CLI support around rebalancing could be considered related, deployment verification and file-based troubleshooting input are undeclared capabilities, so this is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied code does not perform a one-step Safe rebalance. It defines tests for verify_deployment_config, supplying mocked on-chain deployment data and asserting whether the parsed summary matches those values. Its purpose is validation of deployment/config consistency, not executing trades, invoking Safe actions, or applying rebalancing policies operationally. This is a materially different primary purpose from the declared description.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This function submits and waits for an on-chain rebalancing transaction immediately after computing a plan, with no built-in confirmation, dry-run, or explicit acknowledgment step in this file. In an agent skill context, that means a caller can trigger irreversible asset trades directly from automation, increasing the risk of unintended or manipulated execution.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: nanoid==3.3.11 — 3 advisory(ies): CVE-2026-67214 (nanoid: non-secure generators can loop indefinitely with negative size); CVE-2026-67213 (nanoid: custom generators can loop indefinitely when size is zero); CVE-2026-73086 (nanoid: Integer Overflow or Wraparound)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: postcss==8.5.6 — 4 advisory(ies): CVE-2026-45623 (PostCSS: Arbitrary file read and information disclosure via attacker-controlled ); CVE-2026-69153 (PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappi); CVE-2026-41305 (PostCSS has XSS via Unescaped </style> in its CSS Stringify Output) +1 more

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: rollup==4.58.0 — 1 advisory(ies): CVE-2026-27606 (Rollup 4 has Arbitrary File Write via Path Traversal)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: vite==5.4.21 — 3 advisory(ies): CVE-2026-39365 (Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling); CVE-2026-53571 (vite: `server.fs.deny` bypass on Windows alternate paths); CVE-2026-53632 (launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

Dependency has known vulnerabilities (CVEs). Using packages with unpatched security flaws exposes the environment to known exploits.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.17.1 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

ws is a runtime dependency via ethers, so unlike the build/test packages it may be present in production executions of the skill. If the skill establishes WebSocket connections to untrusted or attacker-influenced endpoints, the listed memory disclosure or memory exhaustion issues could affect confidentiality or availability.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation instructs users to provide an executor private key in an environment variable but does not give explicit operational security guidance for storing, loading, rotating, or restricting that key. In a financial automation skill, weak key-handling practices can lead directly to wallet compromise and unauthorized rebalance execution or fund loss.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest says the skill is a "One-step Safe rebalancer using on-chain 31Third policies," which implies a narrowly scoped trade execution capability. However, the exposed interface also includes addPolicy, removePolicy, setCooldown, and setExecutor, meaning the module can reconfigure who may execute and which policies govern execution, not merely perform a single rebalance step.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

A one-step rebalancer would be expected to validate and execute a rebalance against existing controls. Exposing addPolicy/removePolicy lets the same skill alter the governing policy set itself, which is a distinct governance/administration capability not inherently required for performing a rebalance.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The ABI/userdoc include setExecutor and setCooldown, allowing reassignment of the authorized executor and modification of execution timing controls. Those are scheduler/authorization administration functions, not direct requirements of carrying out a single rebalance action.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The rebalance-now path invokes rebalance_now, which by name strongly suggests a live portfolio or on-chain rebalance that could alter assets or system state. This file provides usage text and prints results, but it does not display any warning, confirmation prompt, or other user-facing disclosure before executing that operation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The code requires TOT_API_KEY and EXECUTOR_WALLET_PRIVATE_KEY from process.env, including a private key used to sign transactions. This file provides no warning, prompt, or comment alerting users that sensitive credentials are being accessed and used for network and transaction-signing operations.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · dist/src/rebalance-now.js (reported line 45)May include surrounding context.

js

apiKey: 'key',
    rpcUrl: 'https://mainnet.base.org',
    chainId: 8453,
    apiBaseUrl: 'https://api.31third.com/1.3',
    maxSlippage: 0.01,
    maxPriceImpact: 0.05,
    minTradeValue: 0.1,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · dist/tests/rebalance-now.test.js (reported line 10)May include surrounding context.

js

apiKey: 'key',
    rpcUrl: 'https://mainnet.base.org',
    chainId: 8453,
    apiBaseUrl: 'https://api.31third.com/1.3',
    maxSlippage: 0.01,
    maxPriceImpact: 0.05,
    minTradeValue: 0.1,

Static analysis

No suspicious patterns detected.