Skip to content
← Registry
Trust Report

zyfai

Earn yield on any Ethereum wallet on Base, Arbitrum, and Plasma. Use when a user wants passive DeFi yield on their funds. Deploys a non-custodial subaccount (Safe) linked to their EOA, enables automated yield optimization, and lets them deposit/withdraw anytime.

82
SUSPICIOUS
Format: openclawScanner: v0.7.1Duration: 34msScanned: 7d ago · Apr 2, 6:01 AMSource →
Embed this badge
AgentVerus SUSPICIOUS 82AgentVerus SUSPICIOUS 82AgentVerus SUSPICIOUS 82
[![AgentVerus](https://agentverus.ai/api/v1/skill/23edc4d6-4ab2-4b88-b791-62f09b6a09d8/badge)](https://agentverus.ai/skill/23edc4d6-4ab2-4b88-b791-62f09b6a09d8)
Community Discussion

Community Comments

Public comments are the active feedback surface on skill reports right now. Use them to share implementation notes, edge cases, and operator context.

0 comments

Sign in to comment on this skill

No comments yet. Be the first to share your thoughts.

Continue the workflow

Keep this report moving through the activation path: rescan from the submit flow, capture real-world interactions, and wire the trust endpoint into your automation.

https://agentverus.ai/api/v1/skill/23edc4d6-4ab2-4b88-b791-62f09b6a09d8/trust
Personalized next commands

Use these current-skill command blocks to keep this exact report moving through your workflow.

Record an interaction
curl -X POST https://agentverus.ai/api/v1/interactions \
  -H "Authorization: Bearer at_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{"agentPlatform":"openclaw","skillId":"23edc4d6-4ab2-4b88-b791-62f09b6a09d8","interactedAt":"2026-03-15T12:00:00Z","outcome":"success"}'
Fetch trust JSON
curl https://agentverus.ai/api/v1/skill/23edc4d6-4ab2-4b88-b791-62f09b6a09d8/trust

Category Scores

72
Permissions
100
Injection
71
Dependencies
55
Behavioral
90
Content
100
Code Safety

Findings (10)

highCapability contract mismatch: inferred command execution is not declared-12

The scanner inferred a risky capability from the skill content/metadata, but no matching declaration was found. Add a declaration with a clear justification, or remove the behavior.

Content pattern: exec

Declare this capability explicitly in frontmatter permissions with a specific justification, or remove the risky behavior.

permissionsASST-03
highCapability contract mismatch: inferred network access is not declared-6

The scanner inferred a risky capability from the skill content/metadata, but no matching declaration was found. Add a declaration with a clear justification, or remove the behavior.

Content pattern: https://sdk.zyf.ai

Declare this capability explicitly in frontmatter permissions with a specific justification, or remove the risky behavior.

permissionsASST-04
highCapability contract mismatch: inferred package bootstrap is not declared-10

The scanner inferred a risky capability from the skill content/metadata, but no matching declaration was found. Add a declaration with a clear justification, or remove the behavior.

Content pattern: npm install

Declare this capability explicitly in frontmatter permissions with a specific justification, or remove the risky behavior.

permissionsASST-03
highFinancial/payment actions detected (inside code block)-15

Found financial/payment actions pattern: "Send funds"

3. DEPOSIT → Send funds to subaccount (starts earning)

Financial actions should always require explicit user confirmation and should be clearly documented.

behavioralASST-09
highFinancial/payment actions detected-15

Found financial/payment actions pattern: "wallet"

description: Earn yield on any Ethereum wallet on Base, Arbitrum, and Plasma. Use when a user wants passive DeFi yield on their funds. Deploys a non-custodial subaccount (Safe) linked to their EOA, en

Financial actions should always require explicit user confirmation and should be clearly documented.

behavioralASST-09
highMany external URLs referenced (4)-8

The skill references 4 external URLs and also discusses auth/API/payment workflows, which increases the chance that sensitive operations depend on many remote endpoints.

URLs: https://sdk.zyf.ai, https://t.me/paul_zyfai, https://docs.zyf.ai, https://github.com/ondefy/zyfai-sdk-demo

Minimize external dependencies to reduce supply chain risk.

dependenciesASST-04
highPackage bootstrap execution detected (inside code block)-15

Found package bootstrap execution pattern: "npm install"

npm install @zyfai/sdk viem

Surface package bootstrap commands for review. Ephemeral package execution and install-time dependency pulls increase supply-chain risk, especially when versions are not pinned or provenance is unclear.

behavioralASST-04
mediumUnknown external reference-8

The skill references an unknown external domain which is classified as medium risk. Merged overlapping signals from the repeated finding family: - Unknown external reference

https://sdk.zyf.ai

Verify that this external dependency is trustworthy and necessary.

dependenciesASST-04
lowUnknown external reference-5

The skill references an unknown external domain which is classified as low risk.

https://t.me/paul_zyfai

Verify that this external dependency is trustworthy and necessary.

dependenciesASST-04
infoSafety boundaries defined

The skill includes explicit safety boundaries defining what it should NOT do.

Safety boundary patterns detected in content

Keep these safety boundaries. They improve trust.

contentASST-09