Security audit
defi-yield
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly implements a DeFi APY/strategy helper, but it includes unexpected built-in billing (calls out to skillpay.me) with a hard-coded API key and references a missing tracking script — these inconsistencies warrant caution before installing or running.
This skill mostly does what it says (APY queries and strategy suggestions), but there are several red flags you should consider before installing or running it: - Billing surprise: The included Python scripts call a local billing module that attempts to charge a small amount (0.001) via skillpay.me before proceeding. This monetization behavior is not declared in the SKILL.md or registry metadata — ask the author why billing is embedded and whether it will run automatically. - Hard-coded secret: skillpay.py contains a hard-coded BILLING_API_KEY and SKILL_ID in source. That is sensitive information and a sign of sloppy or unsafe handling of credentials. If you must use this skill, request that the key be removed and that billing be implemented via a configurable, documented environment variable or omitted entirely. - Missing file: The documentation refers to a position_tracker.py script for wallet scans, but that file is not provided. Expect missing functionality or errors if you try to use wallet-tracking features. - Network activity: The scripts make outbound API requests (yearn.vision, api.beefy.finance, yields.llama.fi and skillpay.me). Only run them in environments where outbound network calls are acceptable and from a trusted source. Recommended actions: contact the skill author to (1) explain/justify billing and remove hard-coded keys, (2) provide the missing position_tracker implementation or update documentation, or (3) provide a version of the scripts without billing calls. If you cannot verify these, avoid installing or running the skill in a production environment or any environment with sensitive data.
Static analysis
No suspicious patterns detected.