ClawHub
Back to skill

Security audit

arcadia-finance

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly transparent about being a DeFi API wrapper, but its generic remote tool-calling interface is broad for financial workflows and deserves careful review before use.

Install only if you trust Arcadia's MCP endpoint and are comfortable sending public wallet/account details and transaction parameters to it. Review every returned transaction in your wallet before signing, do not pass private keys or secrets as arguments, and be cautious because the skill can invoke remote tools beyond the fixed examples shown locally.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill explicitly instructs the agent to execute a local shell script (`arcadia.sh`) and declares runtime dependencies (`curl`, `jq`), which are shell execution capabilities, yet no corresponding permissions are declared. Undeclared shell capability weakens sandboxing and trust boundaries because a host may allow the skill to run with broader execution power than users expect.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The documented interface exposes generic remote MCP tool discovery (`--list`) and arbitrary tool invocation (`<tool_name> '<json_args>'`) against a remote server, which goes beyond the narrowly described DeFi operations. If the backend exposes additional or changed tools, an agent could be induced to call unintended capabilities, creating a confused-deputy risk and expanding the attack surface to whatever the remote MCP service chooses to serve.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The script silently sends user-supplied tool names and JSON arguments to a remote MCP endpoint, with no user-facing disclosure or confirmation beyond a comment in the source. In a finance/DeFi skill, arguments may contain wallet addresses, position identifiers, strategy parameters, or other sensitive operational data, so undisclosed transmission creates a real privacy and trust risk.

External Transmission

Medium
Category
Data Exfiltration
Content
}

# Initialize session
INIT_RESPONSE=$(curl -s -X POST "$MCP_URL" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -D "$HEADERS_FILE" \
Confidence
89% confidence
Finding
This network call initializes a session with an external server, transmitting client metadata and establishing a remote interaction channel. While expected for an MCP client, it is still an external data transmission and contributes to privacy and supply-chain risk because the script defaults to a remote service without strong user warning or trust controls.

External Transmission

Medium
Category
Data Exfiltration
Content
PAYLOAD=$(jq -nc --arg name "$TOOL_NAME" --argjson args "$ARGS_JSON" \
    '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":$name,"arguments":$args}}')

  RESPONSE=$(curl -sf -X POST "$MCP_URL" \
    -H "Content-Type: application/json" \
    -H "Accept: application/json, text/event-stream" \
    -H "Mcp-Session-Id: $SESSION_ID" \
Confidence
96% confidence
Finding
This call transmits the selected tool name and full user-supplied JSON arguments to a remote MCP server. In the context of DeFi liquidity management, those arguments can reveal financially sensitive details or trigger high-impact remote actions, so sending them off-box without strong disclosure, consent, or minimization is a genuine security risk.

Static analysis

No suspicious patterns detected.