Security audit
Security checks for vulnerabilities and agentic risk
This is a coherent DeFi security research skill, with expected external API use and helper scripts, but users should handle network lookups, dependencies, and API keys carefully.
Install only if you are comfortable with a research skill that performs live web and blockchain API lookups. Do not submit confidential protocol names, unreleased addresses, or private investigation targets unless external disclosure is acceptable. Use a dedicated low-privilege Etherscan API key, avoid storing unrelated secrets in parent .env files, and review any unpinned npx, pip, or pipe-to-shell installation command before running it.
scripts/onchain-check.sh:597Mutable Remote Installer Is Recommended for Direct Shell Execution
scripts/onchain-check.sh:363Etherscan API Key Is Loaded Broadly and Exposed in a Command-Line URL
scripts/layerzero-dvn-check.py:17Installation Instructions Use Unpinned Third-Party Dependencies
The declared description suggests a broader DeFi protocol audit capability covering vulnerabilities, mechanism safety, and risk factors for a project or protocol. The supplied code does not perform substantive protocol analysis or smart contract auditing. Instead, it is a shell script that calls GoPlus Security endpoints for specific entities: token contracts, addresses, NFT contracts, approval risks, and dApp URLs. Its main added logic is formatting and summarizing token risk flags returned by the API. While this is loosely related to security/risk checking in the DeFi ecosystem, the primary behavior is narrower and materially different from a DeFi protocol audit. Therefore the description overstates the skill's actual behavior.
The description promises a general-purpose DeFi security/risk audit capability, but the code only checks one specific aspect of one interoperability system: LayerZero V2 DVN verifier configuration for an OApp. It connects to Ethereum RPC endpoints, reads getUlnConfig from fixed LayerZero contracts, prints required/optional DVNs, and derives a basic risk label from quorum counts. That is a specialized bridge configuration assessment, not a comprehensive DeFi protocol vulnerability or mechanism-safety analysis. This is a material purpose mismatch, not just an implementation detail.
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
ouncil multisig on Squads with a **2-of-5 threshold** and a **0-second timelock**. On March 27, 2026, the multisig was migrated to a new configuration that reduced the effective trust threshold.
The admin key could:
- List new markets and specify oracle sources
- Modify withdrawal limits
- Transfer vault authority
- Access insurance fund and revenue pool
A 2/5 threshold with zero timelock meant social-engineering just two signers was sufficient to drain the entire protocol. Signers were not publicly doxxed.
**Detectable before hack: YES.** The 2/5 threshold and 0s timelock were visible on-chain via Squads.
### 2. Oracle & Price Feeds -- CRITICAL
Drift's `initializeSpotMarket` function allowed the admin to directly specify `oracle` address and `source` parameters. Any token -- even a fabricated one with no Pyth feed -- could be listed with an arbitrary oracle as collateral.
No independent validation, no governance vote, no minimum liquidity or market cap requirement for collateral
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
ouncil multisig on Squads with a **2-of-5 threshold** and a **0-second timelock**. On March 27, 2026, the multisig was migrated to a new configuration that reduced the effective trust threshold.
The admin key could:
- List new markets and specify oracle sources
- Modify withdrawal limits
- Transfer vault authority
- Access insurance fund and revenue pool
A 2/5 threshold with zero timelock meant social-engineering just two signers was sufficient to drain the entire protocol. Signers were not publicly doxxed.
**Detectable before hack: YES.** The 2/5 threshold and 0s timelock were visible on-chain via Squads.
### 2. Oracle & Price Feeds -- CRITICAL
Drift's `initializeSpotMarket` function allowed the admin to directly specify `oracle` address and `source` parameters. Any token -- even a fabricated one with no Pyth feed -- could be listed with an arbitrary oracle as collateral.
No independent validation, no governance vote, no minimum liquidity or market cap requirement for collateral
YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).
ouncil multisig on Squads with a **2-of-5 threshold** and a **0-second timelock**. On March 27, 2026, the multisig was migrated to a new configuration that reduced the effective trust threshold.
The admin key could:
- List new markets and specify oracle sources
- Modify withdrawal limits
- Transfer vault authority
- Access insurance fund and revenue pool
A 2/5 threshold with zero timelock meant social-engineering just two signers was sufficient to drain the entire protocol. Signers were not publicly doxxed.
**Detectable before hack: YES.** The 2/5 threshold and 0s timelock were visible on-chain via Squads.
### 2. Oracle & Price Feeds -- CRITICAL
Drift's `initializeSpotMarket` function allowed the admin to directly specify `oracle` address and `source` parameters. Any token -- even a fabricated one with no Pyth feed -- could be listed with an arbitrary oracle as collateral.
No independent validation, no governance vote, no minimum liquidity or market cap requirement for collateral
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
**Admin Key Surface Area:**
- The MasterChef contract owner controls critical functions: adding/modifying pools, setting CAKE allocation points, and setting the migrator contract. The migrator function can move LP tokens between exchanges -- a significant power.
- PancakeSwap states it uses "multisig for all contracts" but does not publicly disclose the multisig threshold, the number of signers, or the signer identities.
- The Timelock contract (0xA1f482Dc58145Ba2210bC21878Ca34000E2e8fE4) enforces a minimum 6-hour delay on governance actions, with a maximum of 30 days and a 14-day grace period.
**Timelock Concerns:**
The script automatically reads ETHERSCAN_API_KEY from local .env files without explicit user confirmation. In an agent or automation environment, this creates credential-access behavior that may unintentionally consume secrets from the workspace and then transmit them to an external service, expanding the trust boundary beyond the caller's explicit input.
api_key="${ETHERSCAN_API_KEY:-}"
fi
# Try loading from .env file if still missing
if [ -z "$api_key" ]; then
local env_file
for env_file in ".env" "../.env" "${BASH_SOURCE[0]%/*}/../.env"; do
This line parses ETHERSCAN_API_KEY out of local .env files, confirming active credential harvesting from repository-local files rather than only using explicit runtime parameters. In shared workspaces, agents may access secrets unrelated to the immediate task, and those secrets are then used in outbound requests to third-party APIs.
# Try loading from .env file if still missing
if [ -z "$api_key" ]; then
local env_file
for env_file in ".env" "../.env" "${BASH_SOURCE[0]%/*}/../.env"; do
if [ -f "$env_file" ]; then
local loaded
loaded=$(grep -E '^ETHERSCAN_API_KEY=' "$env_file" 2>/dev/null | head -1 | cut -d'=' -f2- | tr -d '"'"'" )
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
echo "step will be skipped entirely." >&2
echo "" >&2
echo "Setup (choose one):" >&2
echo " 1. Add to .env file: echo 'ETHERSCAN_API_KEY=your_key' >> .env" >&2
echo " 2. Export in shell: export ETHERSCAN_API_KEY=your_key" >&2
echo " 3. Pass as argument: $0 etherscan <addr> <chain_id> <api_key>" >&2
echo "" >&2
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
echo "step will be skipped entirely." >&2
echo "" >&2
echo "Setup (choose one):" >&2
echo " 1. Add to .env file: echo 'ETHERSCAN_API_KEY=your_key' >> .env" >&2
echo " 2. Export in shell: export ETHERSCAN_API_KEY=your_key" >&2
echo " 3. Pass as argument: $0 etherscan <addr> <chain_id> <api_key>" >&2
echo "" >&2
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
clawhub install truenorth-lj/crypto-project-security-skill
mkdir -p .claude/skills/defi-security-audit cp SKILL.md .claude/skills/defi-security-audit/SKILL.md
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
clawhub install truenorth-lj/crypto-project-security-skill
mkdir -p .claude/skills/defi-security-audit cp SKILL.md .claude/skills/defi-security-audit/SKILL.md
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
mkdir -p .claude/skills/defi-security-audit cp SKILL.md .claude/skills/defi-security-audit/SKILL.md
## Trigger Phrases
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
mkdir -p .claude/skills/defi-security-audit cp SKILL.md .claude/skills/defi-security-audit/SKILL.md
## Trigger Phrases
This markdown file defines invocation phrases such as "analyze protocol [protocol]", "check security of [protocol]", and "is [protocol] safe?" without narrowing context or giving exclusion examples. These phrases are generic enough to match common conversation about protocols, which can cause unintended activation of the skill.
The style guidance states "All content in English," which imposes a language policy across skill outputs. This is a natural-language policy violation because it forces a specific language without offering user choice or documenting a justified locale restriction.
The README describes API lookups and on-chain verification workflows but does not clearly warn that protocol names, contract addresses, and URLs may be transmitted to third-party services. This creates a privacy and data-handling risk because users may supply sensitive investigation targets or unreleased addresses assuming analysis is local.
The trigger phrases include broad language like check security of [protocol name] and is [protocol name] safe?, which can overlap with generic security questions and cause the skill to activate outside narrowly intended DeFi-audit contexts. That increases the chance of unintended invocation and unnecessary external lookups or misleading domain-specific analysis on unrelated user requests.
The README documents sending protocol identifiers to DeFiLlama endpoints, which is an external transmission of user-supplied analysis targets. In a security-audit skill, such transmissions may expose confidential research interests or unreleased project identifiers if users are not clearly informed and prompted before network access.
TVL, audit counts, and protocol metadata:
Protocol info: https://api.llama.fi/protocol/{slug}
All protocols: https://api.llama.fi/protocols
Yields: https://yields.llama.fi/pools
The All protocols endpoint similarly indicates network interaction with a third party and can contribute to disclosure of user intent or enrichment behavior not obvious to the user. While expected for this skill's function, lack of transparent disclosure and consent makes it a genuine privacy/control issue.
Protocol info: https://api.llama.fi/protocol/{slug}
All protocols: https://api.llama.fi/protocols
Yields: https://yields.llama.fi/pools
The GoPlus API integration transmits token contracts, addresses, or URLs to an external service for security checks. Because these inputs can be sensitive in an investigation context, undisclosed external transmission may leak user data or research targets to a third party, making this more significant in a security-analysis skill than in a generic public-data lookup tool.
Automated token and address security scanning across 40+ EVM chains. Free, no API key required.
Base URL: https://api.gopluslabs.io/api/v1
Token check: /token_security/{chain_id}?contract_addresses={addr}
Address check: /address_security/{addr}?chain_id={chain_id}
Approval risk: /approval_security/{chain_id}?contract_addresses={addr}
The trigger phrases are very broad, including common requests like 'check security' or 'is it safe', which can cause the skill to activate in contexts far beyond DeFi protocol audits. Over-broad triggering increases the chance that sensitive user data, unrelated projects, or arbitrary URLs/contracts are sent to external services as part of the audit workflow without sufficiently specific user intent.
The skill instructs use of curl against DeFiLlama using user-derived protocol names/slugs, causing external transmission of user-supplied audit targets to a third party. In a security-analysis skill this is contextually expected, but it still creates data exposure risk because user interests, unpublished protocol names, or internal targets may be disclosed externally.
First, resolve the protocol name to the correct DeFiLlama slug (slugs are non-obvious, e.g., "maker" not "sky", "pancakeswap" not "pancake-swap"):
# Fetch all protocols and fuzzy-match by name
curl -s 'https://api.llama.fi/protocols' | jq -r '.[] | select(.name | test("{protocol}"; "i")) | "\(.slug) -- \(.name) -- TVL: \(.tvl)"'
If no match, try partial name or check the protocol's website for its DeFiLlama listing.
Then fetch full data with the resolved slug: curl -s 'https://api.llama.fi/protocol/{slug}' to get:
No suspicious patterns detected.