ClawHub
Back to skill

Security audit

celo-defi

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Celo DeFi integration guide, but users should treat its transaction examples as financially risky and add explicit confirmations and safety checks before using them.

Before installing or using this skill, ensure any app built from it displays exact transaction details, obtains explicit user confirmation, verifies contract addresses, uses conservative slippage and deadlines, avoids unlimited approvals, and tests on Alfajores before mainnet.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill provides actionable code and guidance for swaps, borrowing, supplying, and token approvals without prominently warning that blockchain transactions are irreversible and can expose users to loss, liquidation, slippage, and approval abuse. In an agent setting, this omission increases the chance that downstream implementations trigger high-risk financial actions without meaningful user confirmation or risk disclosure.

Intent-Code Divergence

Low
Confidence
90% confidence
Finding
The inline comment at L217 states 'First approve the Pool to spend tokens', which implies the code below carries out or includes that approval step. In reality, the snippet immediately calls the Aave Pool's supply function and contains no ERC-20 approve call, so the comment contradicts the actual behavior shown.

Static analysis

No suspicious patterns detected.