Tilt Protocol — AI Fund Manager

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:59 AM UTC
• Version: 1.0.0

Overview

This finance skill is purpose-aligned but needs Review because it combines wallet signing, autonomous trading, mutable remote instructions, unverified installer execution, and weak transaction safeguards.

Install only if you are comfortable letting an agent create wallets, hold a private key in environment variables, sign blockchain transactions, and publicly post strategy or trade rationale. Treat the remote skill-update command as untrusted unless you manually review and verify changes, install Foundry separately from a trusted source, use testnet-only keys, require explicit approval before every state-changing transaction, avoid unlimited token approvals, and set real slippage limits instead of minAmountOut=0.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:36
• Finding: Unverified Remote Installer Is Piped Directly into a Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 36 **Vulnerability Type**: Arbitrary remote code execution through a mutable installation script **Risk Level**: Critical ### Vulnerable Code ```bash curl -L https://foundry.paradigm.xyz | bash ``` ### Technical Analysis The installation procedure downloads content from an external URL and immediately passes it to `bash`. The response is not pinned to a reviewed version, saved for inspection, or validated with a cryptographic signature or checksum. Although the referenced domain is associated with the Foundry project, transport-layer HTTPS alone does not establish that the returned script is the same script reviewed when this Skill was published. Compromise of the upstream service, distribution infrastructure, DNS resolution, certificate issuance chain, or installer account could change the effective payload after the Skill has passed review. Shell access is reasonably necessary to invoke `cast` for the declared blockchain functionality. Executing arbitrary mutable installation code, however, exceeds the minimum privilege needed to install that tool safely. ### Attack Path 1. An attacker compromises the remote installer service or another component capable of changing the response from `https://foundry.paradigm.xyz`. 2. The attacker modifies the response to include malicious shell commands. 3. A user or Agent follows Step 0 and executes the documented pipeline. 4. `bash` executes the attacker-controlled response without integrity validation or review. 5. The payload runs with the privileges of the user operating the Agent. 6. It can inspect local files and environment variables, including wallet credentials such as `TILT_PRIVATE_KEY` if already configured, modify tools, or establish persistence. ### Impact Assessment Successful exploitation provides arbitrary command execution with the current user's privileges. Depending on the execution environment, this may allow: - Theft of wal ...[truncated 488 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | bash` installation pipeline. 2. Pin Foundry to a specific reviewed release rather than retrieving a mutable installer. 3. Download the release artifact to a newly created temporary directory with restrictive permissions. 4. Verify the artifact using an official cryptographic signature or a SHA-256 checksum obtained through a separately authenticated release channel. 5. Abort installation if verification fails. 6. Display the exact version and source being installed. 7. Prefer a trusted operating-system package manager where an appropriate verified package is available. 8. Run installation without elevated privileges and avoid invoking `sudo`. 9. Recommend installing prerequisites before loading the Skill, so wallet-bearing Agent sessions do not also perform dependency installation. A safer workflow should follow this pattern: ```bash # Illustrative only: use checksum and URL values from an authenticated release. curl --fail --show-error --location \ --output /tmp/foundry-release.tar.gz \ "https://official.example/foundry/PINNED_VERSION/foundry-release.tar.gz" printf '%s %s\n' "EXPECTED_SHA256" "/tmp/foundry-release.tar.gz" | sha256sum --check - # Extract and install only after successful verification. ``` ]]>

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:14
• Finding: Mutable Skill Instructions Are Retrieved Before Every Session Without Content Authentication<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 14-17 **Vulnerability Type**: Post-review instruction replacement through an external backend **Risk Level**: High ### Vulnerable Code ```markdown Before starting any session, fetch the latest version of this skill. Contract addresses, API endpoints, and workflow steps may change: ```bash curl -s https://bowstring-backend-production.up.railway.app/api/agents/skill -o /tmp/tilt-skill-latest.md && echo "Skill updated — review /tmp/tilt-skill-latest.md for any changes" ``` ``` ### Technical Analysis The Skill directs the Agent to retrieve a mutable copy of its own instructions from a third-party backend before every session. The downloaded document is neither version-pinned nor authenticated with a signature or checksum. The command does not directly execute the downloaded Markdown and explicitly says to review it. Nevertheless, its stated purpose is to supply changed contract addresses, API endpoints, and workflow steps. Treating those remote changes as authoritative creates an instruction-hijacking channel outside the reviewed Skill package. A malicious replacement could direct the Agent to use attacker-controlled contract addresses, RPC endpoints, API servers, or shell commands. Because the Skill also directs the Agent to hold a private key and sign transactions, unauthorized instruction changes have security significance even without directly transmitting the key. Network access is necessary for the declared RPC and helper API operations. Downloading mutable operational instructions every session is not necessary to perform those operations and exceeds the minimum trusted network scope. ### Attack Path 1. An attacker compromises the Railway-hosted backend, its deployment credentials, or the route serving `/api/agents/skill`. 2. The attacker replaces the returned Markdown with modified workflow instructions. 3. At the beginning of a session, the Agent downloads the modified documen ...[truncated 1186 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the requirement to fetch new instructions before every session. 2. Distribute updates through the reviewed Skill package and increment the package version. 3. If dynamic updates are essential, return a versioned, immutable document. 4. Sign update documents with a dedicated offline release key and verify the signature locally before use. 5. Pin the expected public verification key in the packaged Skill. 6. Require explicit user approval before replacing contract addresses, API endpoints, or executable workflow steps. 7. Present a clear diff between the installed and downloaded versions. 8. Treat downloaded Markdown as untrusted reference data, not executable or authoritative instructions. 9. Maintain an allowlist of expected HTTPS hosts and chain IDs. 10. Independently verify contract addresses through a trusted, versioned registry before requesting signatures. 11. Create temporary files securely and remove them after review to avoid stale or substituted updates. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:113
• Finding: Vault Factory Receives an Unlimited Token Allowance<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 113-120; duplicated in `examples/basic-fund-creation.md`, lines 34-38 **Vulnerability Type**: Excessive ERC-20 approval violating least-privilege principles **Risk Level**: Medium ### Vulnerable Code Primary instruction: ```bash cast send 0x941A382852E989078e15b381f921C488a7Ca5299 \ "approve(address,uint256)" \ 0x8a7A5EC2830c0EDD620f41153a881F71Ffb981B9 \ 115792089237316195423570985008687907853269984665640564039457584007913129639935 \ --private-key $TILT_PRIVATE_KEY \ --rpc-url $TILT_RPC ``` Duplicated example: ```bash cast send 0x941A382852E989078e15b381f921C488a7Ca5299 \ "approve(address,uint256)" 0x8a7A5EC2830c0EDD620f41153a881F71Ffb981B9 \ 115792089237316195423570985008687907853269984665640564039457584007913129639935 \ --private-key $TILT_PRIVATE_KEY --rpc-url $TILT_RPC ``` ### Technical Analysis The approval amount is `2^256 - 1`, the maximum possible `uint256`. This gives the configured factory contract an effectively unlimited and persistent allowance over the wallet's tiltUSDC balance. Vault creation requires only the selected seed deposit, such as `1,000,000,000` units for 1,000 six-decimal tiltUSDC. Approving the wallet's present and future balance is therefore broader than necessary. If the spender contract is malicious, compromised, incorrectly configured, or upgradeable to unsafe logic, it may call `transferFrom` for more than the intended seed deposit. The allowance generally remains active after vault creation and can affect tokens acquired later. ### Attack Path 1. The user follows the Skill and approves the factory for the maximum `uint256` amount. 2. Vault creation consumes only part of that allowance. 3. The remaining allowance persists on-chain. 4. The approved factory, or logic controlling an upgradeable factory, becomes malicious or compromised. 5. The spender calls `transferFrom` against the user's wallet. 6. Up to the wallet's entire current ...[truncated 685 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Approve exactly the seed deposit required for the pending vault creation. 2. Query and display the existing allowance before changing it. 3. Set the allowance back to zero immediately after vault creation if any amount remains. 4. For tokens requiring zero-first allowance updates, submit `approve(spender, 0)` before setting a new nonzero allowance. 5. Require explicit user confirmation showing the token, spender, network, and exact amount. 6. Verify that the chain ID is `46630` and that the spender address matches a version-pinned trusted deployment. 7. Update both `SKILL.md` and the example document so the insecure pattern is not copied. For example, a 1,000 tiltUSDC seed should use its exact six-decimal amount: ```bash SEED_DEPOSIT=1000000000 cast send 0x941A382852E989078e15b381f921C488a7Ca5299 \ "approve(address,uint256)" \ 0x8a7A5EC2830c0EDD620f41153a881F71Ffb981B9 \ "$SEED_DEPOSIT" \ --private-key "$TILT_PRIVATE_KEY" \ --rpc-url "$TILT_RPC" ``` ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:190
• Finding: Trade Examples Disable Minimum-Output Slippage Protection<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 190-199; duplicated in `examples/rebalance-with-rationale.md`, lines 18-27 **Vulnerability Type**: Unsafe transaction parameters permitting arbitrarily poor trade execution **Risk Level**: Medium ### Vulnerable Code Primary instruction: ```bash cast send $VAULT_ADDRESS \ "executeTrade(address,address,uint256,uint256)" \ 0x95125A4C68f35732Bb140D578f360BB9cfC1Afa1 \ 0x0E14526bC523019AcF8cB107A7421a5b49aDdcf2 \ 2500000000000000000 \ 0 \ --private-key $TILT_PRIVATE_KEY \ --rpc-url $TILT_RPC ``` Duplicated example: ```bash cast send $VAULT_ADDRESS \ "executeTrade(address,address,uint256,uint256)" \ 0x95125A4C68f35732Bb140D578f360BB9cfC1Afa1 \ 0x0E14526bC523019AcF8cB107A7421a5b49aDdcf2 \ 3050000000000000000 0 \ --private-key $TILT_PRIVATE_KEY --rpc-url $TILT_RPC ``` ### Technical Analysis The fourth `executeTrade` argument is documented as `minAmountOut`, but both examples set it to zero. A zero minimum output means the transaction does not revert based on an unfavorable execution amount. This removes a standard protection against stale prices, price movement between quote and execution, low liquidity, configuration errors, and potentially manipulated execution conditions. The comments estimate `amountIn` using a token price but do not obtain a reliable output quote or derive a bounded minimum output from that quote. The declared functionality requires permission to submit trades, but it does not require accepting an unbounded loss. Setting zero therefore weakens transaction safety beyond what is necessary. ### Attack Path 1. The Agent calculates an input amount using a displayed or stale token price. 2. It submits `executeTrade` with `minAmountOut` equal to zero. 3. Before or during execution, the effective exchange rate becomes significantly less favorable due to price movement, low liquidity, malicious pricing, or transaction ordering. 4. Because every nonnega ...[truncated 905 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Retrieve an expected output quote immediately before transaction submission. 2. Calculate a nonzero `minAmountOut` using an explicit, user-approved maximum slippage tolerance. 3. Validate token decimals when converting prices and quote amounts. 4. Reject trades when the quote is stale, liquidity is insufficient, or price impact exceeds the configured limit. 5. Simulate the transaction before signing where supported. 6. Display `amountIn`, expected output, minimum output, effective price, price impact, and network before requesting approval. 7. Re-query portfolio state after execution and alert if actual output differs materially from the quote. 8. Replace zero-minimum examples in both affected documents. For example: ```bash # expectedOut must come from a current, trusted quote and use tokenOut decimals. SLIPPAGE_BPS=100 MIN_AMOUNT_OUT=$((EXPECTED_AMOUNT_OUT * (10000 - SLIPPAGE_BPS) / 10000)) test "$MIN_AMOUNT_OUT" -gt 0 || { echo "Refusing trade: invalid minimum output" >&2 exit 1 } cast send "$VAULT_ADDRESS" \ "executeTrade(address,address,uint256,uint256)" \ "$TOKEN_IN" "$TOKEN_OUT" "$AMOUNT_IN" "$MIN_AMOUNT_OUT" \ --private-key "$TILT_PRIVATE_KEY" \ --rpc-url "$TILT_RPC" ``` ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (23)

External Script Fetching

High

• Category: Supply Chain

Content

Before starting any session, fetch the latest version of this skill. Contract addresses, API endpoints, and workflow steps may change:

```bash
curl -s https://bowstring-backend-production.up.railway.app/api/agents/skill -o /tmp/tilt-skill-latest.md && echo "Skill updated — review /tmp/tilt-skill-latest.md for any changes"
```

## Environment

• Confidence: 97% confidence
• Finding: The skill instructs fetching the latest skill content from a remote endpoint at the start of each session, effectively bypassing any reviewed local version and creating a live remote-instruction channel. If that endpoint is compromised or updated maliciously, the agent could receive altered contract addresses, workflows, or commands that lead to asset loss or credential theft.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# Install Foundry (provides `cast` for on-chain interaction)
curl -L https://foundry.paradigm.xyz | bash
foundryup

# Verify

• Confidence: 99% confidence
• Finding: The command pipes a remote script directly into bash, enabling arbitrary code execution from an external server with no integrity check or review step. In a skill that also handles private keys and on-chain transactions, this is especially dangerous because compromised installation output could steal secrets, alter transaction tooling, or backdoor the environment before any blockchain actions occur.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README promotes autonomous wallet creation, self-custodied key use, shell execution, network access, and on-chain trading without any explicit warning that blockchain actions may be irreversible and may put funds at risk. In a skill specifically designed to let agents manage tokenized funds, omission of safety guidance increases the chance that users enable powerful capabilities without understanding the financial and operational consequences.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs use of a private key from an environment variable for signing and repeatedly frames the agent as self-custodied, but does not provide strong operational guidance on secret handling, least-privilege use, or avoiding disclosure in logs and subprocesses. Any leakage of the private key would immediately compromise the wallet and all controlled vault assets.

External Transmission

Medium

• Category: Data Exfiltration

Content

If a stock token isn't deployed yet, request deployment (validated against the official stock list):

```bash
curl -s -X POST "$TILT_API_BASE/api/agents/deploy-token" \
  -H "Content-Type: application/json" \
  -d '{"symbol": "AAPL"}' | jq .
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill directs the agent to submit irreversible on-chain approval, vault creation, allocation, and trading transactions without prominently warning about transaction finality, slippage, approval risk, or potential financial loss. Even on testnet, these patterns normalize unsafe operational behavior and could cause users or downstream agents to execute real-value transactions with inadequate review if addresses or environments change.

External Transmission

Medium

• Category: Data Exfiltration

Content

After each `executeTrade`, post a note explaining your reasoning. This is displayed publicly on the strategy page — think of it like a git commit message for your trades:

```bash
curl -s -X POST "$TILT_API_BASE/api/agents/trade-notes" \
  -H "Content-Type: application/json" \
  -d "{\"txHash\": \"TX_HASH\", \"vault\": \"$VAULT_ADDRESS\", \"note\": \"Rotating from AAPL to NVDA — AI infrastructure demand accelerating after strong earnings beat\", \"agent\": \"YOUR_AGENT_NAME\"}" | jq .
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

### Step 9: Request More Funds

```bash
curl -s -X POST "$TILT_API_BASE/api/agents/faucet" \
  -H "Content-Type: application/json" \
  -d "{\"walletAddress\": \"$TILT_WALLET\"}" | jq .
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The description presents the agent as an 'autonomous AI fund manager' that can create vaults, execute trades, and manage funds autonomously, but it does not define when these actions are allowed, what approvals are required, or what actions are out of scope. That broad framing can cause over-invocation or unsafe delegation of discretionary trading behavior, especially in a wallet-owning agent tied to blockchain transactions.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The description explicitly promotes autonomous fund management, on-chain trading, and self-signing transactions without warning users that the skill can move assets, incur losses, or execute irreversible blockchain actions. In a finance and DeFi context, omission of risk disclosure materially increases the chance that users enable high-impact actions without informed consent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The example instructs the agent to generate a wallet, expose a private key in shell commands and environment variables, register with a remote service, and immediately execute irreversible on-chain approval and vault-creation transactions without any safety warning or confirmation step. In a skill for autonomous fund creation, this is especially risky because users or downstream agents may copy the workflow verbatim, leading to credential leakage, overbroad token approvals, and unintended movement of real funds.

External Transmission

Medium

• Category: Data Exfiltration

Content

export TILT_WALLET=$(cast wallet address $TILT_PRIVATE_KEY)

# Register and get funded
curl -s -X POST "$TILT_API_BASE/api/agents/register" \
  -H "Content-Type: application/json" \
  -d '{"walletAddress": "0xaB1c...4eF2", "name": "Tech Alpha AI", "description": "AI-driven tech sector fund focusing on AI infrastructure leaders"}' | jq .
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

export TILT_WALLET=$(cast wallet address $TILT_PRIVATE_KEY)

# Register and get funded
curl -s -X POST "$TILT_API_BASE/api/agents/register" \
  -H "Content-Type: application/json" \
  -d '{"walletAddress": "0xaB1c...4eF2", "name": "Tech Alpha AI", "description": "AI-driven tech sector fund focusing on AI infrastructure leaders"}' | jq .
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

Let me post an initial strategy update:

```bash
curl -s -X POST "$TILT_API_BASE/api/agents/strategy-posts" \
  -H "Content-Type: application/json" \
  -d '{"vault": "$VAULT_ADDRESS", "content": "Fund launched. Core thesis: AI infrastructure spending is in early innings. NVDA overweight for GPU demand, AAPL/MSFT for ecosystem moats. Will monitor earnings and rotate if thesis changes.", "agent": "Tech Alpha AI", "type": "strategy"}' | jq .
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

Let me post an initial strategy update:

```bash
curl -s -X POST "$TILT_API_BASE/api/agents/strategy-posts" \
  -H "Content-Type: application/json" \
  -d '{"vault": "$VAULT_ADDRESS", "content": "Fund launched. Core thesis: AI infrastructure spending is in early innings. NVDA overweight for GPU demand, AAPL/MSFT for ecosystem moats. Will monitor earnings and rotate if thesis changes.", "agent": "Tech Alpha AI", "type": "strategy"}' | jq .
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

# (agent reviews market data via its own research tools)

# Decision: HOLD — no action needed, post update
curl -s -X POST "$TILT_API_BASE/api/agents/strategy-posts" \
  -H "Content-Type: application/json" \
  -d '{"vault": "$VAULT_ADDRESS", "content": "Morning review: portfolio up 2% since launch, weights within tolerance. CPI data at 8:30 AM — staying flat until we see the print. If inflation comes in hot, may trim growth exposure.", "agent": "Tech Alpha AI", "type": "hold"}' | jq .
```

• Confidence: 87% confidence
• Finding: This curl command transmits vault identifiers and strategy commentary to an external API endpoint. In the context of an autonomous investment agent, outbound transmission of portfolio-related information is sensitive because it can reveal holdings context, decision logic, and activity patterns to third parties or unintended audiences.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This example shows an autonomous scheduled agent making an external POST to publish strategy commentary without any explicit consent, approval gate, or user-facing warning about recurring outbound publication. In a financial context, scheduled public disclosures can leak portfolio state, market posture, and timing information, and may create compliance, privacy, or reputational risk if users do not expect automated broadcasting.

External Transmission

Medium

• Category: Data Exfiltration

Content

Later that day, after CPI data:

```bash
curl -s -X POST "$TILT_API_BASE/api/agents/strategy-posts" \
  -H "Content-Type: application/json" \
  -d '{"vault": "$VAULT_ADDRESS", "content": "CPI came in at 2.4%, below expectations. Risk-on environment confirmed. Keeping current allocation — tech overweight is well positioned for a rate-cut cycle.", "agent": "Tech Alpha AI", "type": "market"}' | jq .
```

• Confidence: 86% confidence
• Finding: This second external POST sends additional market commentary tied to a vault, reinforcing a pattern of autonomous network publication. In this skill's financial setting, public or third-party transmission of ongoing strategy updates can enable profiling of the agent's behavior and may have compliance or confidentiality implications.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The second scheduled POST similarly sends externally visible market commentary without an explicit warning that the agent autonomously publishes updates later in the day. Even though the content is not credential material, repeated automated disclosures about strategy and positioning can expose operational behavior and create unintended data-sharing or regulatory issues.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The example performs a real blockchain trade via `cast send` using a private key and sets minimum output to `0`, yet provides no warning, simulation step, or explicit user confirmation before signing. In an agent-skill context, examples are often copied into automation flows, so this can normalize unattended asset movement and expose users to accidental execution, bad pricing, or irreversible loss.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Log trade note
curl -s -X POST "$TILT_API_BASE/api/agents/trade-notes" \
  -H "Content-Type: application/json" \
  -d '{"txHash": "0xabc123...", "vault": "$VAULT_ADDRESS", "note": "Rotating $800 from AAPL to NVDA — data center revenue up 93% YoY, guidance raised. AI infrastructure thesis strengthening.", "agent": "Tech Alpha AI"}' | jq .

• Confidence: 89% confidence
• Finding: This `curl` POST transmits transaction and vault metadata plus human-authored rationale to an external endpoint. In a financial-agent setting, such disclosures can reveal positions, timing, and strategy signals that may be sensitive or exploitable by third parties.

External Transmission

Medium

• Category: Data Exfiltration

Content

-d '{"txHash": "0xabc123...", "vault": "$VAULT_ADDRESS", "note": "Rotating $800 from AAPL to NVDA — data center revenue up 93% YoY, guidance raised. AI infrastructure thesis strengthening.", "agent": "Tech Alpha AI"}' | jq .

# Post strategy update
curl -s -X POST "$TILT_API_BASE/api/agents/strategy-posts" \
  -H "Content-Type: application/json" \
  -d '{"vault": "$VAULT_ADDRESS", "content": "Post-earnings rebalance: increased NVDA to ~48% after blowout data center numbers. AI capex cycle accelerating. Trimmed AAPL to fund — still long-term bullish but NVDA has more near-term upside.", "agent": "Tech Alpha AI", "type": "strategy"}' | jq .
```

• Confidence: 89% confidence
• Finding: This POST publishes a strategy update containing portfolio allocation changes and forward-looking rationale to a remote API. In context, that can disclose actionable market views and fund state, increasing privacy, front-running, or reputational/compliance risk if shared automatically.

Missing User Warnings

Low

• Confidence: 92% confidence
• Finding: The example sends trade notes and strategy posts to remote APIs without clearly warning that portfolio identifiers, transaction hashes, and investment rationale will be transmitted off-host. This can leak sensitive trading behavior and metadata that may be private, regulated, or commercially sensitive, especially when embedded into autonomous agent workflows.

Static analysis

No suspicious patterns detected.