ClawHub
Back to skill

Security audit

Miraix LI.FI Earn Agent

Security checks for vulnerabilities and agentic risk

Overview

This skill is transparent about helping users deposit USDC into yield vaults, but it gives an agent broad wallet-execution guidance without enough confirmation or transaction validation.

Review this skill carefully before installing. It should only be used with small amounts and a wallet you are prepared to risk unless the workflow is changed to require explicit confirmation before each approval and deposit, show decoded transaction details, verify contract addresses, limit approvals, and simulate transactions before signing.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:44
Finding

Unvalidated External Transaction Parameters May Cause Unauthorized Token Approvals or Deposits

Content
View full analysis
", "walletAddress":"", "fromAmount":"1000000", "fromTokenAddress":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913" }' ``` 6. For execution: - Prefer an embedded or Agentic Wallet connected in Miraix. - Execute approval first if `estimate.approvalAddress` is present and allowance is insufficient. - Execute the Composer deposit transaction. ``` ### Technical Analysis The workflow instructs the agent to use the first vault recommended by an external service as the default target and subsequently execute approval and deposit transactions derived from that service. It does not require independent verification of critical transaction properties, including: - Whether the vault and approval spender are trusted contracts. - Whether the returned chain, token, amount, recipient, and calldata match the user's request. - Whether the requested allowance is limited to the exact deposit amount. - Whether the transaction has unexpected token transfers or contract calls. - Whether the expected receipt token is authentic. - Whether the transaction succeeds in a simulation without unintended state changes. - Whether the user has reviewed and explicitly confirmed the final decoded transactions. The mere presence of `estimate.approvalAddress` is treated as sufficient grounds to approve that address. Consequently, a compromised, faulty, or manipulated API response could cause the wallet to approve an ...[truncated 1804 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

  1. Call the Miraix Earn discovery endpoint:
bash
curl -sS -X POST https://app.miraix.fun/api/earn/chat \
  -H 'Content-Type: application/json' \
  -d '{"message":"Put 1 USDC into the safest vault on Base"}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill instructs the agent to proceed from discovery to wallet approval and deposit execution without requiring an explicit, separate user confirmation immediately before each irreversible onchain action. In a wallet-connected agent context, this can lead to unintended approvals or deposits if the user's intent is misinterpreted, parameters change between recommendation and execution, or the agent acts too autonomously.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill enables implicit invocation without defining clear boundaries for when it should or should not activate. Because this agent can recommend vaults, prepare deposits, and interact with an Agentic Wallet, ambiguous auto-invocation increases the chance of triggering financial actions in contexts the user did not explicitly intend, which can lead to unsafe fund movement or misleading transaction preparation.

Content

No source excerpt is available for this finding.