Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed DeFi portfolio-analysis guide that uses external portfolio APIs but does not include hidden execution, transaction signing, persistence, or destructive behavior.
Before installing, be aware that using the example commands can reveal wallet addresses, position IDs, portfolio details, and API keys to third-party DeFi data providers. Use read-only API keys where possible, review provider terms, and do not supply wallet private keys or seed phrases.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Free alternative — Zapper API:
curl -s "https://api.zapper.xyz/v2/balances?addresses[]=0xYOUR_WALLET&networks[]=ethereum&networks[]=arbitrum" \
-H "Authorization: Basic $(echo -n ':YOUR_ZAPPER_KEY' | base64)"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Uniswap v3 IL is range-dependent. Use the official SDK or Revert Finance API:
# Revert Finance — v3 position analytics
curl "https://api.revert.finance/v1/position?position_id=YOUR_NFT_ID&chain_id=1"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Uniswap v3 IL is range-dependent. Use the official SDK or Revert Finance API:
# Revert Finance — v3 position analytics
curl "https://api.revert.finance/v1/position?position_id=YOUR_NFT_ID&chain_id=1"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Pull staking reward history via The Graph (Lido example)
curl -X POST "https://api.thegraph.com/subgraphs/name/lidofinance/lido" \
-H "Content-Type: application/json" \
-d '{
"query": "{ totalRewards(where: {account: \"0xYOUR_WALLET\"}, orderBy: block, orderDirection: desc, first: 100) { id totalRewards totalFee block blockTime } }"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Pull staking reward history via The Graph (Lido example)
curl -X POST "https://api.thegraph.com/subgraphs/name/lidofinance/lido" \
-H "Content-Type: application/json" \
-d '{
"query": "{ totalRewards(where: {account: \"0xYOUR_WALLET\"}, orderBy: block, orderDirection: desc, first: 100) { id totalRewards totalFee block blockTime } }"
The manifest focuses on tracking and analytics outputs for reporting, tax handoff, and dashboards, and explicitly says the skill is not for real-time price alerts on spot holdings without active DeFi positions. The 'Monitoring & Alerts' section adds operational alerting behavior, including health-factor thresholds and out-of-range detection, which extends beyond the described reporting-oriented scope even if related to DeFi positions.
The manifest states the skill 'outputs structured data for portfolio reporting, tax handoff ... and treasury dashboards.' In contrast, the workflow explicitly says to 'Generate markdown summary for treasury dashboard,' which adds a presentation/content-generation capability not clearly justified by the stated structured-data purpose.