DeFi Yield Monitor

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:01 AM UTC
• Version: 1.1.0

Overview

This skill appears purpose-aligned, but it installs and repeatedly runs mutable external code for sensitive DeFi portfolio monitoring without integrity controls.

Review carefully before installing. Only use this if you are comfortable cloning and running the external GitHub project under your user account, storing wallet addresses locally, and potentially sending portfolio summaries to chat services. Prefer a pinned, reviewed version of the monitor, avoid automated cron reports until integrity checks and removal instructions exist, and use a dedicated wallet/channel if privacy matters.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/setup.sh:5

Finding

Mutable Remote Repository Is Downloaded and Executed Without Integrity Verification

Content

View full analysis

/dev/null || true else echo "Cloning $REPO_URL → $DIR" git clone "$REPO_URL" "$DIR" fi ``` ```bash # scripts/run.sh:24 exec .venv/bin/python main.py --config config/config.json "$MODE" ``` ### Technical Analysis The audited package does not contain the monitoring application's Python implementation. Instead, the setup script clones the mutable `main` branch of an external GitHub repository or updates an existing checkout using `git pull`. The runtime script subsequently executes `main.py` from that checkout. No immutable commit identifier, signed release, cryptographic digest, or trusted manifest is verified before execution. Consequently, the effective code executed by the Skill can change after this package has been reviewed. HTTPS protects the network connection but does not establish that future upstream content is the same code that was audited. The use of `git pull --ff-only` prevents non-fast-forward updates but does not prevent malicious or compromised upstream commits from being downloaded and executed. ### Attack Path 1. An attacker compromises the upstream GitHub account, repository, maintainer credentials, or an authorized development workflow. 2. The attacker adds malicious code to the upstream `main` branch, including code in `main.py` or imported modules. 3. A user runs `scripts/setup.sh`. 4. The setup script clones the compromised repository or pulls the new commit into an existing checkout ...[truncated 1030 chars]

Remediation

View remediation

T06 · System Persistence

Error

• Location: SKILL.md:61

Finding

Instructions Encourage Persistent Scheduled Execution of Externally Sourced Code

Content

View full analysis

/scripts/run.sh --yield-summary` - **Delivery**: announce to user's Telegram/Discord ``` ### Technical Analysis The Skill instructs the Agent to create a cron job that survives the current run and invokes `scripts/run.sh` twice daily. That script executes the monitoring application from the external repository managed by `scripts/setup.sh`. Scheduled reporting may be a legitimate feature, but the instruction establishes cross-session execution without documenting an approval boundary, integrity controls, expiration, or removal procedure. Its risk is amplified because the scheduled target can be changed through the mutable upstream update mechanism. ### Attack Path 1. The Agent follows `SKILL.md` and creates the suggested recurring cron job. 2. The setup script initially clones the external repository or later pulls changes from its `main` branch. 3. The upstream repository or local checkout is compromised or modified. 4. At the next scheduled time, the cron job invokes `scripts/run.sh` without a new interactive user decision. 5. `run.sh` executes the modified Python application. 6. The malicious payload continues to run on subsequent scheduled intervals until the job is removed or execution fails. ### Impact Assessment The scheduled job provides repeated execution under the identity that owns the cron entry. A compromised target could repeatedly access user-readable files, configuration data, environment-dependent resources, and permitted network destinations. This finding does not establish that a cron job is created automatically by the bundled scripts; persistence occurs only if an Agent or user f ...[truncated 129 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/setup.sh:27

Finding

Unquoted Pip Requirement Disables the Intended Version Constraint

Content

View full analysis

=2.32.0 ``` ### Technical Analysis The requirement containing `>=` is not quoted. In Bash, `>` is a redirection operator, so the command is parsed rather than passed to pip as the intended `requests>=2.32.0` requirement. Pip effectively receives an unconstrained `requests` requirement, while command output is redirected to a file named `=2.32.0` in the working directory. Even if the requirement were quoted, a lower-bound-only dependency constraint would still permit future, unaudited releases. The setup script also lacks a lock file and package hashes, making installation non-reproducible and preventing verification of dependency artifacts. ### Attack Path 1. A user runs `scripts/setup.sh`. 2. Bash interprets `>` as output redirection instead of part of the package requirement. 3. Pip resolves and installs an unconstrained available version of `requests`. 4. A file named `=2.32.0` is created or truncated in the project directory. 5. If an incompatible or compromised package release is selected from the configured package index, its installation or runtime behavior affects the monitoring environment. No malicious `requests` release or package-index compromise is established by the audited files; the vulnerability is the loss of the intended constraint and absence of integrity pinning. ### Impact Assessment The direct effects are: - Installation of a dependency version outside the intended lower-bound constraint. - Non-reproducible environments whose behavior can change over time. - Unintended creation or truncation of `=2.32.0` in the project directory. - Increased supply-chain exposure to future releases selected by pip. A malicious dependency could execute code during installation or when imported, with the privile ...[truncated 207 chars]

Remediation

View remediation

' ``` 2. Use an exact, reviewed version rather than a floating lower bound. 3. Maintain a lock file containing hashes and install with hash enforcement, for example: ```bash .venv/bin/pip install --require-hashes -r requirements.lock ``` 4. Pin all transitive dependencies, not only the top-level package. 5. Configure pip to use an explicitly trusted package index and disable unexpected extra indexes. 6. Review and update locked dependencies through a controlled process that includes vulnerability scanning and testing. 7. Remove any accidentally created `=2.32.0` file from affected project directories. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger list is unusually broad and includes generic terms like "APY," "Aave," and non-English terms for holdings/yield, which can cause the skill to activate during ordinary financial conversations. In this context, accidental invocation matters because the skill is designed to inspect sensitive wallet/portfolio data and may initiate network access or reporting workflows without the user clearly intending that specific action.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation tells users to store wallet addresses and describes collecting data from public endpoints plus optional delivery to Telegram/Discord, but it does not clearly warn that wallet identifiers and portfolio metadata may be transmitted to third-party services. Even though wallet addresses are public on-chain, aggregating them with portfolio balances, health factors, and scheduled reporting creates a meaningful privacy and operational security risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 81% confidence

Finding

The skill instructs users to persist wallet addresses in a local config file under the workspace and to create ongoing snapshots/reports, which introduces session persistence of sensitive financial metadata. In a DeFi monitoring context this is more dangerous than ordinary app state because retained wallet mappings, historical balances, and health-factor snapshots can reveal portfolio composition and become a target for local compromise or unintended reuse by other tools.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

First-Time Setup

Run the setup script to clone the project, create venv, and init config:

bash

bash <skill_dir>/scripts/setup.sh

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The header comment on L02 describes the script as running the monitor with auto proxy detection, but the body also changes into a project directory and launches .venv/bin/python main.py --config config/config.json "$MODE". This is a documentation mismatch because the comment emphasizes only the proxy-related behavior rather than the primary effect of executing the monitor.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.