SUPAH DeFi Optimizer

DeFi yield optimization, impermanent loss tracking, and portfolio management for Base blockchain. Find the best yields, monitor LP positions, and optimize De...

Security Scan

The skill's code and instructions mostly match its DeFi purpose, but a few mismatches and an embedded automatic micropayment flow (x402 pay-to address) introduce financial and configuration risks that the user should understand before installing.

Purpose & Capability

Name/description, API endpoints, and bundled index.js align with a DeFi optimizer for Base. Requiring node is expected. Requiring curl (declared in SKILL.md) is unnecessary given the included index.js uses Node's https — this is a minor mismatch but not proof of malicious intent. The SUPAH_API_BASE env var is a reasonable override for the API base URL.

Instruction Scope

SKILL.md and index.js only call the SUPAH API for wallet/position data — no file system or secret harvesting. However, SKILL.md specifies an automatic x402 micropayment model and embeds a payTo address; the agent's 'x402-compatible HTTP client pays automatically' implies the skill will trigger value transfers on each call. That is out-of-band behavior (economic transfers) that users should treat as a risk. Also, while SKILL.md metadata restricts outbound host to api.supah.ai, the code honors SUPAH_API_BASE if set — a maliciously set env var could redirect traffic to another host.

Install Mechanism

There is no download/install script; this is instruction-only with a small node script included. Nothing in the install surface writes arbitrary archives or executes remote installers. Risk from install mechanism is low.

Credentials

The skill only requests one env var (SUPAH_API_BASE) and no secrets, which is proportionate. Caveat: SUPAH_API_BASE can be used to point the skill at any endpoint if the user sets it, so ensure it's set only to the official API. The embedded x402 payTo address is not a secret but encodes where user funds will be sent — this is a non-credential risk (financial outflow) and should be acknowledged.

Persistence & Privilege

The skill does not request always:true, does not modify other skills, and has no system config paths. It can be invoked autonomously (platform default), which combined with the micropayment behavior increases the blast radius if the agent is allowed to act without limits.

What to consider before installing

This skill appears to implement the described DeFi features, but note two practical risks before installing: (1) Each call triggers an x402 micropayment to the embedded address (check and accept the payTo address and costs; set limits). (2) The SUPAH_API_BASE env var can override the API host — only set it to a trusted URL (default is https://api.supah.ai). Recommended steps: verify the publisher (look up the GitHub repo or the official supah.ai site), run the included index.js in a sandbox to inspect responses, restrict agent autonomy or set a per-call budget so the agent cannot make many paid calls automatically, and avoid providing private keys or wallet secrets to this skill. If you rely on a corporate or controlled environment, have an operator review the payTo address and x402 client behavior first.

DeFi yield optimization, impermanent loss tracking, and portfolio management for Base blockchain.

Description

Auto-find best yields, get rebalancing suggestions, track impermanent loss, and optimize your DeFi positions with AI-powered recommendations. Built on SUPAH's data pipeline which utilizes Moralis for on-chain DeFi position indexing and protocol data.

Features

• Auto-Optimization: Find best yields automatically
• IL Calculator: Track impermanent loss in real-time
• Rebalancing: Smart position adjustment suggestions
• APY Comparison: Compare yields across protocols
• Yield Alerts: Get notified of rate changes
• Historical Tracking: Monitor performance over time

Usage

• "Show my DeFi positions: [wallet]"
• "Optimize my yield farming"
• "Compare APYs on Base"
• "Calculate IL for my position"
• "Suggest rebalancing for [wallet]"

Pricing

x402 USDC micropayments on Base — pay per call, no subscriptions.

Action	Price	What You Get
APY comparison	$0.02	Top yields across Base protocols
IL calculation	$0.05	Impermanent loss analysis for position
Position scan	$0.03	All DeFi positions for a wallet
Optimization report	$0.10	AI-powered rebalancing suggestions
Yield alert	$0.005/alert	Rate change notification

Your agent's x402-compatible HTTP client pays automatically. No API keys needed. How x402 works

Data Infrastructure

SUPAH's DeFi optimization engine is built on and utilizes Moralis for on-chain DeFi data — LP positions, protocol interactions, token approvals, and yield farming activity. SUPAH processes this through its proprietary optimization algorithms to generate actionable yield strategies and risk-adjusted recommendations.

Data flow: Moralis (DeFi positions + protocol data) → SUPAH Engine (yield optimization + IL calculation) → x402 API → Your Agent

Links

• Website: https://supah.ai
• API: https://api.supah.ai
• Telegram: https://t.me/SUPAH_Based
• X: https://x.com/Supah_BASED_AI

License

MIT