Starknet DeFi Toolkit

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:52 AM UTC
• Version: 1.0.0

Overview

This Starknet toolkit mostly matches its stated purpose, but its scaffold command can overwrite or create Cairo files in unintended locations from unchecked input.

Review before installing. The read/query features are ordinary public API/RPC use, but run scaffold only in a clean project directory, use simple identifier-like names and symbols, and inspect generated Cairo before compiling or deploying it. The publisher should remove the unused pip dependency and add filename validation, source escaping, and overwrite protection.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/starknet_toolkit.py:220

Finding

Path Traversal, File Overwrite, and Cairo Source Injection in Scaffold Generation

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: SKILL.md:32

Finding

Unnecessary and Unpinned Third-Party Dependency Installation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The module docstring explicitly characterizes the toolkit as 'read-only,' yet the code later opens a file in write mode and saves generated output. This is an active contradiction between stated intent and implemented behavior, not merely omitted detail.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module docstring describes the skill as a 'read-only Starknet DeFi CLI,' which implies observation, querying, and simulation. However, the documented and implemented 'scaffold' subcommand emits an ERC-20 contract skeleton and writes it to disk, which is code generation rather than read-only DeFi inspection.

Content

No source excerpt is available for this finding.

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · scripts/starknet_toolkit.py (reported line 59)May include surrounding context.

python

if not token_addr:
        print(f"Unknown token {args.token}. Known: {', '.join(MAINNET_TOKENS)}", file=sys.stderr)
        sys.exit(1)
    selector_balance = "0x2e4263f5f8b3b3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e"
    # Real balanceOf selector is 0x2e4263f5f8b3b3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e
    # Use the well-known ERC-20 selector for balanceOf
    BALANCE_OF_SELECTOR = 0x2e4263f5f8b3b3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · scripts/starknet_toolkit.py (reported line 60)May include surrounding context.

python

if not token_addr:
        print(f"Unknown token {args.token}. Known: {', '.join(MAINNET_TOKENS)}", file=sys.stderr)
        sys.exit(1)
    selector_balance = "0x2e4263f5f8b3b3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e"
    # Real balanceOf selector is 0x2e4263f5f8b3b3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e
    # Use the well-known ERC-20 selector for balanceOf
    BALANCE_OF_SELECTOR = 0x2e4263f5f8b3b3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · scripts/starknet_toolkit.py (reported line 62)May include surrounding context.

python

if not token_addr:
        print(f"Unknown token {args.token}. Known: {', '.join(MAINNET_TOKENS)}", file=sys.stderr)
        sys.exit(1)
    selector_balance = "0x2e4263f5f8b3b3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e"
    # Real balanceOf selector is 0x2e4263f5f8b3b3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e
    # Use the well-known ERC-20 selector for balanceOf
    BALANCE_OF_SELECTOR = 0x2e4263f5f8b3b3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · scripts/starknet_toolkit.py (reported line 67)May include surrounding context.

python

if not token_addr:
        print(f"Unknown token {args.token}. Known: {', '.join(MAINNET_TOKENS)}", file=sys.stderr)
        sys.exit(1)
    selector_balance = "0x2e4263f5f8b3b3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e"
    # Real balanceOf selector is 0x2e4263f5f8b3b3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e
    # Use the well-known ERC-20 selector for balanceOf
    BALANCE_OF_SELECTOR = 0x2e4263f5f8b3b3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e

Context Window Stuffing

Medium

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.

Content

Scanner excerpt · scripts/starknet_toolkit.py (reported line 75)May include surrounding context.

python

if not token_addr:
        print(f"Unknown token {args.token}. Known: {', '.join(MAINNET_TOKENS)}", file=sys.stderr)
        sys.exit(1)
    selector_balance = "0x2e4263f5f8b3b3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e"
    # Real balanceOf selector is 0x2e4263f5f8b3b3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e
    # Use the well-known ERC-20 selector for balanceOf
    BALANCE_OF_SELECTOR = 0x2e4263f5f8b3b3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e3e

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/starknet_toolkit.py (reported line 99)May include surrounding context.

python

def cmd_price(args):
    sym = args.symbol.upper()
    cg_id = {"STRK": "starknet", "ETH": "ethereum", "USDC": "usd-coin", "USDT": "tether"}.get(sym, sym.lower())
    url = f"https://api.coingecko.com/api/v3/simple/price?ids={cg_id}&vs_currencies=usd"
    try:
        with urllib.request.urlopen(url, timeout=15) as r:
            data = json.loads(r.read().decode())

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The argparse description presents the tool as a 'Starknet L2 DeFi read/simulate CLI,' but cmd_scaffold creates a new .cairo file on disk. That behavior exceeds a plain read/simulate scope and changes local state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The scaffold command writes a predictable filename in the current directory without warning, confirmation, or safe-create semantics. In automation or agent contexts, this can overwrite an existing file with the same name and cause loss of local work or unintended artifact creation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.