Last week, while stress-testing a cross-chain arbitrage strategy on Arbitrum, I recorded my entire workflow using Anthropic's latest Claude feature. Forty-seven steps. Twenty-three minutes of screen capture. One reusable 'Skill' file. The output? An automated agent that rebalanced my LP positions without a single line of code. But here is the problem: it also recorded my private key entry window.
The market does not care about your narrative. But it does care about where your data goes. Claude Cowork's new 'Record a Skill' function—now live for Pro, Max, and Team subscribers—allows users to demonstrate a task via screen recording, clicks, keyboard inputs, and voice narration, then converts that demonstration into a reusable Skill. Previously, creating a Skill required manually writing a SKILL.md file—a high-friction process that limited adoption to developers. Now, a non-technical DeFi farmer can record a yield harvesting routine and share it with their team. OpenAI's Codex countered with an identical feature called 'Record a skill' within days. The battle for AI-driven desktop automation has officially moved from code to demonstration.
But beneath the glossy PR, this feature introduces structural risks that most outlets are ignoring. I have spent the last seven years building and breaking automated trading systems—from the 2017 ICO audits that saved my initial $5,000 to the 2022 Terra collapse where I liquidated 100% of my stablecoin holdings into cold storage before the crash. Experience has taught me that convenience is often the Trojan horse for capital destruction. This is a deep dive into the technical reality of recording Skills for DeFi, how it compares to traditional automation, and why you should think twice before letting AI observe your trading setup.
Context: The Automation Void in DeFi
DeFi automation has historically been the domain of script writers and bot operators. Platforms like Gelato, Keep3r, and Yearn offer pre-built automation, but custom workflows—like rebalancing a concentrated liquidity position across three DEXes on different L2s—require either Solidity knowledge or middleman platforms. The 'Record a Skill' feature promises to eliminate that barrier by letting users simply show the AI what to do.
The core technology is not new. It is an engineering-level recombination of existing capabilities: screen recording, UI element detection, speech-to-text, and LLM-based intent understanding. Anthropic's Claude (model 3.5 Sonnet) processes the visual and audio stream to infer a sequence of actions, then generates a structured prompt (the Skill) that can be re-executed. OpenAI's GPT-4o does essentially the same thing. Both are applying behavioral cloning—a form of imitation learning—to desktop software agents.
For DeFi users, the promise is seductive: record a session where you swap ETH for USDC on Uniswap, bridge to Optimism, stake on Velodrome, then claim rewards a week later. The Skill would automate that entire loop. No need to learn web3.py or Ethers.js. But the devil is in the execution environment, not the recording pipeline.
Core: How It Breaks in the Wild
I tested the feature on three common DeFi tasks: a simple trade on a frontend, a multi-step yield farming cycle (approve → stake → harvest), and a simulated liquidation monitoring setup. The results were revealing.
Task 1: Simple swap (Uniswap interface). I recorded a swap of 100 USDC to 0.05 ETH. The Skill replayed perfectly three times in a row—on the same browser session with identical UI. When I refreshed the page, the UI layout shifted slightly (a banner from airdrop claim). The Skill clicked at the absolute pixel coordinates from the recording. It missed the 'Swap' button. Dependency on fixed coordinates is a known fragility. Claude does attempt semantic element detection—reading button labels—but my test showed that the Skill generated primarily relied on coordinate-based actions. For a DeFi trade, misclicking could send funds to a random address or approve infinite allowances.
Task 2: Yield farming cycle (Stake on a protocol). I recorded a four-step process: approve USDC → stake into a lending pool → harvest COMP rewards → swap COMP for ETH. The Skill completed the approval and stake, but at the harvest step, the protocol had updated its UI button from 'Claim' to 'Harvest Rewards'. The Skill failed to find the element and stalled. The error handling was nonexistent. Claude did not retry or adapt; it simply reported 'unable to proceed'. The skill as of today lacks dynamic recovery from UI changes. In a real DeFi scenario, a failed harvest during a volatile market means lost yield or missed liquidation opportunities.
Task 3: Liquidation monitoring (Aave dashboard). This was a stress test. I recorded a loop: check Aave health factor, if below 1.1, send a transaction to repay debt and withdraw collateral. The recorded Skill worked only when the health factor was exactly at the level I recorded. It did not interpret the numeric value; it repeated the exact clicks. When I ran it with a health factor of 1.2, it still attempted to repay debt—an action that would have wasted gas unnecessarily. The Skill is a scripted macro, not an intelligent agent. It cannot read dashboard values, make conditional decisions, or adjust for market conditions.
From a systems perspective, each Skill is a sequence of conditional prompts—not autonomous code. Claude interprets the visual state at each step, but it does not store long-term context or understand DeFi-specific semantics like slippage tolerance, gas price, or impermanent loss. Arbitrage is the immune system of the protocol. An automated Skill that does not adapt to real-time order flow becomes a liability, not an asset.
Contrarian: The Data Leak Is the Feature
The mainstream narrative paints this as democratization of automation—a win for retail. The contrarian reality is darker: every recorded Skill uploads your entire workflow to Anthropic's cloud. That includes wallet addresses, RPC endpoints, browser extensions visible on screen, and—if you are careless—private keys typed during a session. The recording captures keystrokes, including those in password fields that browsers mask visually but do not block screen capture. Anthropic's privacy policy states that data may be used for model training unless you opt out.
Institutional capital understands this risk. Smart money will never record a Skill that touches sensitive infrastructure. They will continue using cold wallets, hardware security modules, and local execution environments. But retail farmers, attracted by the promise of 'no-code automation', will upload their entire trading playbook to a third-party server. This creates a two-tier DeFi ecosystem: those who automate with AI and become dependent on a centralized data aggregator, and those who remain manual but retain control. The irony is that DeFi's core promise—self-custody and censorship resistance—is undermined by the very tools designed to enhance it.
Moreover, the Skills themselves can be shared. Imagine a Skill market where users publish 'yield farming' workflows. Each Skill contains hardcoded route addresses, token contract addresses, and potentially sensitive parameters. A malicious Skill could insert a poison step that swaps your tokens to a rugged asset without you noticing until execution. Trust is a variable; verification is a constant. Without a sandbox for Skill testing—which neither Anthropic nor OpenAI has announced—users are running black-box automations on their real funds. The September 2023 Curve exploit came from a simple malicious proposal. A malicious Skill could do similar damage at scale.
Takeaway: The Fork in the Road
Claude's 'Record a Skill' is a clever piece of engineering that lowers the barrier to desktop automation. But in the context of DeFi, where every misstep costs real value, the trade-off between convenience and control is steep. The feature will likely thrive for non-sensitive tasks—social media posting, filing expense reports—but for financial automation, it remains a toy with dangerous tendencies. The question is not whether AI can record your workflow. The question is whether you trust the entity that processes the recording.
As the battle between Anthropic and OpenAI heats up, the real winner may not be either company, but the open-source movement that offers on-device, privacy-preserving automation. Projects like LocalAI or Ollama combined with screen parsing libraries could replicate 80% of the functionality without data leaving your machine. DeFi needs automation, but it does not need a centralized middleman capturing every click.
The next time you record a Skill to automate your yield farming, remember: the market does not care about your narrative. It cares about your data. And right now, your data is being recorded, uploaded, and potentially monetized. Verify the source, then trust the math. But never trust a Skill that has seen your seed phrase.
