Security audit

Clawlett

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real on-chain trading tool, but its Trenches trading script can execute irreversible transactions without the documented execution flag or slippage protection.

Review carefully before installing. Use only with small, disposable amounts unless the Trenches script is changed to enforce an explicit execution flag, nonzero minimum outputs, and exact token-address confirmations in code. Protect the config directory because it contains an agent private key and may contain backend session cookies.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/trenches.js:703
Finding: Trenches operations execute on-chain without enforcing the documented confirmation gate
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/trenches.js:882
Finding: Trenches buy and sell transactions allow arbitrary output loss
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/initialize.js:861
Finding: Authentication session cookies are persisted in plaintext without restrictive file permissions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/tokens.js:52
Finding: Unverified token symbols can resolve to an attacker-controlled DexScreener result
Content: View full analysis
p.chainId === 'base') if (basePairs.length === 0) return null for (const pair of basePairs) { const match = [pair.baseToken, pair.quoteToken].find( t => t.symbol.toUpperCase() === symbol.toUpperCase() ) if (match) { return { id: match.address, symbol: match.symbol, name: match.name, volumeUSD: pair.volume?.h24, liquidity: pair.liquidity?.usd, dex: pair.dexId, } } } return null } ``` The returned address becomes the resolved token: ```js const searchResult = await searchToken(aliasedSymbol) if (searchResult) { const address = ethers.getAddress(searchResult.id) const tokenContract = new ethers.Contract(address, ERC20_ABI, provider) const [onChainSymbol, decimals] = await Promise.all([ tokenContract.symbol(), tokenContract.decimals(), ]) return { address, symbol: onChainSymbol, decimals: Number(decimals), verified: false, name: searchResult.name, volumeUSD: searchResult.volumeUSD, liquidity: searchResult.liquidity, dex: searchResu ...[truncated 2807 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (50)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.
md
| `initialize.js` | Deploy Safe + Roles, register CNS name |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 246)May include surrounding context.
md
| `initialize.js` | Deploy Safe + Roles, register CNS name |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 247)May include surrounding context.
md
| `initialize.js` | Deploy Safe + Roles, register CNS name |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 237)May include surrounding context.
md
| `swap.js` | Swap tokens via KyberSwap Aggregator (default, optimal routes) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 254)May include surrounding context.
md
| `swap.js` | Swap tokens via KyberSwap Aggregator (default, optimal routes) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 255)May include surrounding context.
md
| `swap.js` | Swap tokens via KyberSwap Aggregator (default, optimal routes) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 256)May include surrounding context.
md
| `swap.js` | Swap tokens via KyberSwap Aggregator (default, optimal routes) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 238)May include surrounding context.
md
| `cow.js` | Swap tokens via CoW Protocol (MEV-protected) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 259)May include surrounding context.
md
| `cow.js` | Swap tokens via CoW Protocol (MEV-protected) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 260)May include surrounding context.
md
| `cow.js` | Swap tokens via CoW Protocol (MEV-protected) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 261)May include surrounding context.
md
| `cow.js` | Swap tokens via CoW Protocol (MEV-protected) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 264)May include surrounding context.
md
| `cow.js` | Swap tokens via CoW Protocol (MEV-protected) |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 239)May include surrounding context.
md
| `balance.js` | Check ETH and token balances |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 250)May include surrounding context.
md
| `balance.js` | Check ETH and token balances |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 251)May include surrounding context.
md
| `balance.js` | Check ETH and token balances |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 240)May include surrounding context.
md
| `trenches.js` | Create and trade Trenches tokens via factory |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 267)May include surrounding context.
md
| `trenches.js` | Create and trade Trenches tokens via factory |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 268)May include surrounding context.
md
| `trenches.js` | Create and trade Trenches tokens via factory |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 269)May include surrounding context.
md
| `trenches.js` | Create and trade Trenches tokens via factory |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 270)May include surrounding context.
md
| `trenches.js` | Create and trade Trenches tokens via factory |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 273)May include surrounding context.
md
| `trenches.js` | Create and trade Trenches tokens via factory |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 274)May include surrounding context.
md
| `trenches.js` | Create and trade Trenches tokens via factory |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 275)May include surrounding context.
md
| `trenches.js` | Create and trade Trenches tokens via factory |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 276)May include surrounding context.
md
| `trenches.js` | Create and trade Trenches tokens via factory |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 279)May include surrounding context.
md
| `trenches.js` | Create and trade Trenches tokens via factory |

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/cow.js:250

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/initialize.js:29

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/swap.js:154

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/trenches.js:44