Security audit

Orderly Deposit Withdraw

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Orderly deposit and withdrawal guide, but one deposit example grants persistent unlimited token-spending permission without clear warnings or safer defaults.

Review this skill carefully before using its examples with real funds. Prefer exact-amount ERC-20 approvals, verify contract and destination addresses from trusted Orderly sources, confirm the chain ID before signing, and revoke unused allowances after deposits.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:131
Finding: Unlimited ERC-20 Allowance Exceeds the Required Deposit Amount
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill includes a deposit flow that approves the vault with ethers.MaxUint256 and provides withdrawal examples using destination addresses, but it does not prominently warn about the risks of unlimited ERC20 allowances or irreversible transfers to the wrong address. In a fund-movement skill, this omission is security-relevant because users may copy the example directly, leaving excessive token spending authority in place or sending assets to an incorrect recipient with no recovery path.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.