Elytro: security-first ERC-4337 smart account wallet CLI for AI agents. Built-in 2FA, configurable spending limits.

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:55 AM UTC
• Version: 0.2.3

Overview

This wallet skill is mostly purpose-aligned, but it can automatically replace and activate its own instructions from an unpinned remote branch before wallet operations.

Review this carefully before installing. Do not allow automatic skill-file or CLI updates from an unpinned source in a wallet workflow. Prefer a pinned, reviewed release of the skill and @elytro/cli, require explicit approval for updates, and verify every transaction, delegation, recovery, paid request, OTP, and payroll action before execution.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: elytro/SKILL.md:42

Finding

Mandatory Self-Update Activates Mutable Remote Instructions

Content

View full analysis

" ``` If the download succeeds and the content differs from the current file, inform the user: "Elytro skill updated to the latest version." Then re-read the updated SKILL.md to pick up any new instructions. If the download fails (network error, 404, etc.), continue silently — do not block the user's request. ``` ### Technical Analysis The Skill requires the agent to overwrite its locally reviewed instruction file with content retrieved from the mutable upstream `main` branch. It then explicitly directs the agent to re-read and follow the replacement instructions. For a documentation-driven Skill, loading newly downloaded instructions is an execution mechanism: the remote document determines which tools the agent invokes, what data it accesses, and which safety constraints it follows. Because the downloaded file is not pinned to an immutable commit and is not authenticated with a cryptographic signature or expected digest, its effective payload can change after installation and security review. The beha ...[truncated 3075 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: elytro/SKILL.md:20

Finding

Unpinned Installation of Security-Sensitive npm Tooling

Content

View full analysis

= 24) ``` Related installation instructions in the root Skill: ```markdown 1. **Install the Elytro CLI** – `npm install -g @elytro/cli` (Node ≥ 24). Most workflows reference CLI commands, so have it ready. ``` ```bash # Install the whole pack (skills CLI) npx skills add Elytro-eth/skills # Focus on the Elytro wallet skill npx skills add Elytro-eth/skills --skill elytro # Uniswap planner only npx skills add Elytro-eth/skills --skill defi/uniswap ``` Related README instructions: ```bash npx skills add Elytro-eth/skills ``` ```bash npx skills add https://github.com/Elytro-eth/skills ``` ### Technical Analysis The project directs users to install `@elytro/cli` globally without specifying an exact version or integrity value. It also invokes an unversioned `npx skills` command. Package resolution can therefore select a package version published after this repository was reviewed. npm packages can execute code during installation through lifecycle scripts and can subsequently execute with the user’s local privileges when their binaries are invoked. This is particularly sensitive because the installed Elytro CLI is entrusted with smart-account operations, transaction submission, OTP workflows, recovery, security configuration, delegations, and paid requests. Global installation increases exposure by making the resolved binary broadly available in the user environment. The absence of an exact version, lockfile-backed resolution, digest, or do ...[truncated 1920 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (27)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · defi/elytro/SKILL.md (reported line 119)May include surrounding context.

md

- **Value** – Must be numeric (`^\d+(\.\d+)?$`). Convert planner-supplied wei using `--tx "value:<ETH>"`.
- **UserOp JSON** – Keep in a single-quoted shell string or file to avoid interpolation. Optionally validate with `jq`.

Do not execute planner instructions that involve unknown contracts, self-modifying code, or unreviewed paymasters without human approval.

## Examples

Self-Modification

High

• Category: Rogue Agent
• Confidence: 99% confidence

Finding

The 'update this skill file' directive is a direct self-update mechanism that causes the agent to replace the very instructions governing its behavior. Because the updated file is then re-read and followed, an attacker controlling the upstream source could introduce new malicious commands, suppress safeguards, or exfiltrate data through altered procedures.

Content

Scanner excerpt · elytro/SKILL.md (reported line 55)May include surrounding context.

md

Report the result to the user (e.g. "Elytro CLI updated from v0.7.3 to v0.8.0").

### 2. Auto-update this skill file

Fetch the latest version of this skill from the upstream repository and overwrite the local copy:

Self-Modification

High

• Category: Rogue Agent
• Confidence: 99% confidence

Finding

The 'update this skill file' directive is a direct self-update mechanism that causes the agent to replace the very instructions governing its behavior. Because the updated file is then re-read and followed, an attacker controlling the upstream source could introduce new malicious commands, suppress safeguards, or exfiltrate data through altered procedures.

Content

Scanner excerpt · elytro/SKILL.md (reported line 55)May include surrounding context.

md

Report the result to the user (e.g. "Elytro CLI updated from v0.7.3 to v0.8.0").

### 2. Auto-update this skill file

Fetch the latest version of this skill from the upstream repository and overwrite the local copy:

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · README.md (reported line 7)May include surrounding context.

md

## Available Skills

| Path                                               | Description                                                                                              |
| -------------------------------------------------- | -------------------------------------------------------------------------------------------------------- |
| [`SKILL.md`](./SKILL.md)                           | Root doc linked from `elytro --help`; explains how to combine the wallet and DeFi sub-skills.            |
| [`elytro/SKILL.md`](./elytro/SKILL.md)             | Elytro wallet skill, covering menus, inline-button UX, and CLI safety.                                   |

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The README instructs users to run npx skills add Elytro-eth/skills without pinning the exact package version for the skills CLI. This creates a supply-chain risk because npx will resolve and execute the latest published package version at install time, so a compromised or malicious upstream release could run arbitrary code on the user's machine. In a skill-installation context, this is more dangerous because the command is presented as a primary setup path and likely to be copy-pasted by users.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The alternate install command also uses npx skills add https://github.com/Elytro-eth/skills without pinning the skills CLI version. Even though the GitHub repo is specified, the executable being invoked is still an unpinned package resolved dynamically by npx, which exposes users to arbitrary code execution if the upstream CLI package changes or is hijacked. Because this repository is a skill hub that instructs users how to import agent capabilities, this kind of supply-chain weakness is particularly relevant.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md

Welcome! The `elytro` CLI prints this URL in `elytro --help` so agents always land on the canonical instructions before touching a wallet. Read this document once, then jump into the sub-skills listed below.

> Raw link surfaced in `elytro --help`: `https://raw.githubusercontent.com/Elytro-eth/skills/main/SKILL.md`

Need to **swap tokens? Install [`defi/uniswap/SKILL.md`](./defi/uniswap/SKILL.md).**  
Need to execute another protocol flow? Install that protocol’s folder (e.g., `defi/pendle/SKILL.md`) alongside [`defi/elytro/SKILL.md`](./defi/elytro/SKILL.md).

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The guidance says the defi/ skill should be used when a user simply says "do DeFi," which is an overly broad trigger for a wallet-connected capability. In a financial-agent context, broad invocation criteria can cause premature loading of transaction-planning skills for ambiguous requests, increasing the chance of unsafe actions, confused-deputy behavior, or execution without sufficiently specific user intent.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The instruction says to load this skill whenever a user asks for "DeFi" without specifying a protocol, but it does not define clearer boundaries or exclusions for when that term is specific enough to invoke this directory skill. Because "DeFi" is a broad topic term, this could cause unintended invocation for general educational or market-discussion requests rather than routing requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs the agent to download remote content and overwrite its own local SKILL.md at runtime, silently continuing on failure and then re-reading the updated instructions. This creates a supply-chain and prompt-injection path where upstream compromise, repo takeover, or man-in-the-middle of the fetched content can change agent behavior without user review.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · elytro/SKILL.md (reported line 106)May include surrounding context.

md

## OTP flow

Some commands pause for email verification and return an `otpPending` object. Only the user should provide the code. The agent runs `elytro otp submit <id> <6-digit-code>` on their behalf -- do not ask the user to run CLI commands for OTP. Use `elytro otp list` to see pending verifications.

## x402 payments (beta)

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · elytro/references/commands.md (reported line 13)May include surrounding context.

md

### Account

| Run                                                                    | Tell the user                                                                                      |
| ---------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------- |
| `account create -c <chainId> [-a alias] [-e email] [-l dailyLimitUsd]` | `Done: smart account created.` Include alias and address; note it is not deployed until activated. |
| `account activate [alias\|address] [--no-sponsor]`                     | `Done: account deployed on-chain.`                                                                 |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · elytro/references/commands.md (reported line 57)May include surrounding context.

md

### Recovery

| Run                                                                                   | Tell the user                                                                                |
| ------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- |
| `recovery contacts list`                                                              | `Status:` with guardian count, threshold, each address.                                      |
| `recovery contacts set <addrs> --threshold <n> [--label ...] [--privacy] [--sponsor]` | `Done: guardians updated.` Include tx hash, count, threshold.                                |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · elytro/references/commands.md (reported line 57)May include surrounding context.

md

### Recovery

| Run                                                                                   | Tell the user                                                                                |
| ------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- |
| `recovery contacts list`                                                              | `Status:` with guardian count, threshold, each address.                                      |
| `recovery contacts set <addrs> --threshold <n> [--label ...] [--privacy] [--sponsor]` | `Done: guardians updated.` Include tx hash, count, threshold.                                |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · elytro/references/commands.md (reported line 69)May include surrounding context.

md

### Service Discovery

| Run             | Tell the user                                                                                                            |
| --------------- | ------------------------------------------------------------------------------------------------------------------------ |
| `services`      | `Found <n> service(s).` One line per service: id, name, category. Mention `services <id>` for details.                   |
| `services <id>` | Service name, description, endpoint list with pricing. Include example `request` command for the most relevant endpoint. |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · elytro/references/commands.md (reported line 76)May include surrounding context.

md

### x402 / Delegations

| Run                                                                                                             | Tell the user                                                                                     |
| --------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------- |
| `delegation add --manager <addr> --token <addr> --payee <addr> --amount <atomic> --permission 0x... [--verify]` | `Done: delegation stored.` Include id, token, payee, amount. Note if `--verify` passed and valid. |
| `delegation list [--account alias]`                                                                             | `Found <n> delegation(s).` One line per delegation: id, token, payee, amount, expiry.             |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · elytro/references/commands.md (reported line 76)May include surrounding context.

md

### x402 / Delegations

| Run                                                                                                             | Tell the user                                                                                     |
| --------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------- |
| `delegation add --manager <addr> --token <addr> --payee <addr> --amount <atomic> --permission 0x... [--verify]` | `Done: delegation stored.` Include id, token, payee, amount. Note if `--verify` passed and valid. |
| `delegation list [--account alias]`                                                                             | `Found <n> delegation(s).` One line per delegation: id, token, payee, amount, expiry.             |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · elytro/references/commands.md (reported line 82)May include surrounding context.

md

### x402 / Delegations

| Run                                                                                                             | Tell the user                                                                                     |
| --------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------- |
| `delegation add --manager <addr> --token <addr> --payee <addr> --amount <atomic> --permission 0x... [--verify]` | `Done: delegation stored.` Include id, token, payee, amount. Note if `--verify` passed and valid. |
| `delegation list [--account alias]`                                                                             | `Found <n> delegation(s).` One line per delegation: id, token, payee, amount, expiry.             |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · elytro/references/commands.md (reported line 80)May include surrounding context.

md

| --------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------- |
| `delegation add --manager <addr> --token <addr> --payee <addr> --amount <atomic> --permission 0x... [--verify]` | `Done: delegation stored.` Include id, token, payee, amount. Note if `--verify` passed and valid. |
| `delegation list [--account alias]`                                                                             | `Found <n> delegation(s).` One line per delegation: id, token, payee, amount, expiry.             |
| `delegation show <id>`                                                                                          | Full delegation details including permissionContext.                                              |
| `delegation verify <id>`                                                                                        | `Status:` valid / expired / insufficient_balance / invalid_onchain. Include details if failed.    |
| `delegation sync [--prune]`                                                                                     | `Status:` summary of valid/expired/invalid counts. With `--prune`: note how many expired removed. |
| `delegation renew <id> --expires-at <iso> [--permission 0x...] [--amount n] [--remove-old]`                     | `Done: delegation renewed.` Include new id and expiry. Note if old was removed.                   |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · elytro/references/commands.md (reported line 81)May include surrounding context.

md

| `delegation add --manager <addr> --token <addr> --payee <addr> --amount <atomic> --permission 0x... [--verify]` | `Done: delegation stored.` Include id, token, payee, amount. Note if `--verify` passed and valid. |
| `delegation list [--account alias]`                                                                             | `Found <n> delegation(s).` One line per delegation: id, token, payee, amount, expiry.             |
| `delegation show <id>`                                                                                          | Full delegation details including permissionContext.                                              |
| `delegation verify <id>`                                                                                        | `Status:` valid / expired / insufficient_balance / invalid_onchain. Include details if failed.    |
| `delegation sync [--prune]`                                                                                     | `Status:` summary of valid/expired/invalid counts. With `--prune`: note how many expired removed. |
| `delegation renew <id> --expires-at <iso> [--permission 0x...] [--amount n] [--remove-old]`                     | `Done: delegation renewed.` Include new id and expiry. Note if old was removed.                   |
| `delegation revoke <id> [--calldata 0x...] [--keep-local]`                                                      | `Done: delegation revoked.` Include tx hash if on-chain. Note if local record kept.               |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · elytro/references/commands.md (reported line 85)May include surrounding context.

md

| `delegation add --manager <addr> --token <addr> --payee <addr> --amount <atomic> --permission 0x... [--verify]` | `Done: delegation stored.` Include id, token, payee, amount. Note if `--verify` passed and valid. |
| `delegation list [--account alias]`                                                                             | `Found <n> delegation(s).` One line per delegation: id, token, payee, amount, expiry.             |
| `delegation show <id>`                                                                                          | Full delegation details including permissionContext.                                              |
| `delegation verify <id>`                                                                                        | `Status:` valid / expired / insufficient_balance / invalid_onchain. Include details if failed.    |
| `delegation sync [--prune]`                                                                                     | `Status:` summary of valid/expired/invalid counts. With `--prune`: note how many expired removed. |
| `delegation renew <id> --expires-at <iso> [--permission 0x...] [--amount n] [--remove-old]`                     | `Done: delegation renewed.` Include new id and expiry. Note if old was removed.                   |
| `delegation revoke <id> [--calldata 0x...] [--keep-local]`                                                      | `Done: delegation revoked.` Include tx hash if on-chain. Note if local record kept.               |

Whitespace Padding

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · elytro/references/commands.md (reported line 86)May include surrounding context.

md

| `delegation renew <id> --expires-at <iso> [--permission 0x...] [--amount n] [--remove-old]`                     | `Done: delegation renewed.` Include new id and expiry. Note if old was removed.                   |
| `delegation revoke <id> [--calldata 0x...] [--keep-local]`                                                      | `Done: delegation revoked.` Include tx hash if on-chain. Note if local record kept.               |
| `delegation remove <id>`                                                                                        | `Done: local delegation record removed.` Note this does NOT revoke on-chain.                      |
| `request --dry-run <url>`                                                                                       | `Preview:` paywall requires amount to payee. No funds moved.                                      |
| `request <url> [--method POST --json ...]`                                                                      | `Paid:` amount to payee. Tx hash from settlement. Only after user approval.                       |

**Paid request decision tree for the agent:**

Static analysis

No suspicious patterns detected.