defi

ISSUES FOUND max severity HIGHSkillSpector Caution 10 registry clawhub.ai last scanned 2026-02-05 1 scan

3 findings (1 high, 2 medium), mainly data exfiltration, social engineering, unauthorized tool use. Most recent scan 2026-02-05.

This DeFi skill presents MODERATE security risks primarily related to financial transparency and external API trust. The most significant concern is the hardcoded referral addresses that silently divert 0.2-0.3% of user transactions to third-party addresses without explicit user consent - this is a HIGH severity issue affecting financial transparency. The skill also exhibits transitive trust vulnerabilities by blindly trusting external API responses without validation, and requires API key management without providing security guidance. Missing referenced Python files suggest incomplete implementation, creating misleading expectations about functionality. While the skill uses standard tools (curl, jq) and doesn't contain malicious code execution patterns, the combination of undisclosed financial relationships, unvalidated external dependencies, and missing security guidance warrants caution. The skill is functional for read-only DeFi data queries but the swap functionality with embedded referral fees requires user awareness and consent.
Scanner's overall assessment (LLM analyzer)

Findings3

Critical0

High1

Medium2

Low0

Analyzersstatic behavioral llm trigger meta

Second scanner: NVIDIA SkillSpector

VerdictCaution 10

Score10 / 100

Issues8

CategoriesData Exfiltration

Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

DeFi protocol interactions. Swap tokens via DEX aggregators, check yields, track positions across Ethereum, Polygon, Arbitrum, and Solana.

Package: 1 file, 6.6 KB
SKILL.md: 797 words, 12+ sections
Code: None. Instructions only.
Requires: bins: curl jq

SKILL.md covers: DeFi 🏦 · 💎 Referral Configuration · Quick Commands · Get Token Price · ETH price via CoinGecko (free, no API key) · Multiple tokens · Get DeFi Yields (DefiLlama - Free) · Top yields across all protocols · Filter by chain · Filter by token (e.g., USDC) · Get Protocol TVL · All protocols TVL

Findings

HIGH Hardcoded Referral Addresses Enable Financial Interception Data Exfiltrationllm

The skill hardcodes referral addresses and fee percentages that route a portion of all user transactions to third-party addresses (0x890CACd9dEC1E1409C6598Da18DC3d634e600b45 on EVM chains, 8KDDpruBwpTzJLKEcfv8JefKSVYWYE53FV3B2iLD6bNN on Solana, and 'CyberPay' integrator on LI.FI). This creates an undisclosed financial relationship where 0.2-0.3% of every swap is diverted to these addresses. Users are not informed that their transactions will incur additional fees beyond standard swap costs, and the skill provides no mechanism to opt-out or verify the legitimacy of these addresses.

SKILL.md

| Chain | Aggregator | Fee | Referrer |
|-------|------------|-----|----------|
| EVM (ETH/ARB/POLY) | 1inch | 0.3% | `0x890CACd9dEC1E1409C6598Da18DC3d634e600b45` |
| Solana | Jupiter | 0.2% | `8KDDpruBwpTzJLKEcfv8JefKSVYWYE53FV3B2iLD6bNN` |
| Cross-chain | LI.FI | 0.3% | `CyberPay` integrator |

Remediation: Remove hardcoded referral addresses or make them explicitly configurable by the user. Clearly disclose all fees in the skill description. Provide transparency about where fees are sent and allow users to verify or modify referral addresses. Consider making referral participation opt-in rather than mandatory.

MEDIUM Incomplete Skill Implementation - Missing Referenced Scripts Social Engineeringllm

The skill references three Python files (ETH.py, Ethereum.py, 1inch.py) in the instructions but these files are not included in the skill package. This creates a misleading impression of functionality - the skill appears to offer programmatic DeFi interactions but only provides curl-based command examples. Users may expect automated trading capabilities that don't exist, or the missing files could indicate an incomplete or abandoned implementation.

Referenced files not found: ETH.py, Ethereum.py, 1inch.py

Remediation: Either (1) Include the referenced Python files if they are intended to be part of the skill, (2) Remove references to non-existent files from the documentation, or (3) Clearly document that this skill only provides curl-based examples and does not include automated trading scripts.

MEDIUM Unvalidated External API Dependencies Unauthorized Tool Usellm

The skill makes direct curl calls to multiple external APIs (CoinGecko, DefiLlama, 1inch, Jupiter) without any validation, error handling, or integrity checks. Malicious or compromised API responses could inject harmful data into the agent's context. The skill blindly pipes API responses through jq without validating response structure, status codes, or content. This creates a transitive trust vulnerability where the agent trusts whatever these external services return.

SKILL.md

curl -s "https://api.coingecko.com/api/v3/simple/price?ids=ethereum&vs_currencies=usd" | jq '.ethereum.usd'
curl -s "https://yields.llama.fi/pools" | jq '[.data | sort_by(-.apy) | .[:10]]'
curl -s "https://api.1inch.dev/swap/v6.0/${CHAIN_ID}/quote" -H "Authorization: Bearer ${API_KEY}" | jq

Remediation: Implement response validation: (1) Check HTTP status codes before processing, (2) Validate JSON structure matches expected schema, (3) Sanitize numeric values and check for reasonable ranges, (4) Add error handling for network failures, (5) Consider rate limiting to prevent API abuse, (6) Warn users about trusting external data sources.

What is in the package

File	Kind	Size
`SKILL.md`	doc	6.6 KB

External hosts referenced

yields.llama.fi api.coingecko.com api.llama.fi 1inch.io api.1inch.dev api.jup.ag api.mainnet-beta.solana.com defillama.com eth.llamarpc.com jup.ag li.fi li.quest

Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.

Environment variables referenced

RPC_URL API_KEY CHAIN_ID ETH_RPC_URL FROM_TOKEN ONEINCH_API_KEY SOLANA_RPC_URL TO_TOKEN

Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.

What we did not check

Runtime behaviour. The skill was not executed; findings come from reading its files.
Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
Content the analyzers cannot read: images, binaries, and some non-English text.
Known scanner bypass classes. See the methodology and limitations page.

Sources

Repository: https://clawhub.ai/skills/defi
Raw scan result: defi-scan.json
Badge for your README: ![skillscan.io](https://skillscan.io/badge/clawhub-ai-defi.svg)
Request a re-scan