ClawHub
Back to skill

Security audit

MegaETH AI Developer

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent MegaETH developer guide, but it gives high-impact mainnet wallet, swap, approval, bridge, and deployment instructions with insufficient guardrails for irreversible financial actions.

Review this skill before installing and treat it as high-risk operational guidance. Do not let an agent automatically send, swap, approve, bridge, or deploy on mainnet from these examples. Pin installation sources, use testnet or small amounts first, avoid unlimited approvals, verify chain IDs, addresses, calldata, slippage, gas, and value, and require explicit confirmation before every funds-moving or contract-broadcast step.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T03 · Remote Payload Retrieval and Execution

Error
Location
README.md:20
Finding

Unpinned Remote Dependencies Are Retrieved and Executed

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
wallet-operations.md:187
Finding

Unvalidated Aggregator Calldata Combined with Unlimited Token Approval

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
smart-contracts.md:103
Finding

Mainnet Broadcast Guidance Disables Preflight Simulation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
smart-contracts.md:327
Finding

ERC-6909 Example Permits Unrestricted Public Minting

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (13)

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The README instructs users to run npx skills add ... without pinning a specific package version or commit, which can cause installation of whatever package version is current at execution time. If the upstream package or resolution path is compromised, users may execute unreviewed code during install, creating a supply-chain risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill explicitly encourages wallet setup, transfers, swaps, and bridging, but the examples do not warn that these actions can move real user funds and should require explicit user confirmation and review of addresses, amounts, and networks. In an AI-agent skill context, this increases the chance that an agent will autonomously prepare or initiate high-risk financial operations without adequate safeguards.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This skill directly covers high-risk financial actions such as wallet management, transaction submission, token swaps, and bridging, but it does not prominently warn about irreversible on-chain actions, mainnet asset loss, or the need for explicit user confirmation before moving funds. In an agent context, that omission increases the chance that users or downstream automations will treat operational guidance as safe-by-default and execute destructive or costly actions without adequate friction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The quick-reference section includes live transaction and deployment commands (cast send and forge script ... --broadcast --skip-simulation) against a mainnet RPC without any warning that they perform irreversible on-chain actions. In a developer skill, users may copy-paste these commands directly, which increases the risk of unintended fund transfers, accidental mainnet deployment, or bypassing simulation safeguards.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

This markdown includes concrete examples for eth_sendRawTransactionSync and realtime_sendRawTransaction against the mainnet RPC, which would broadcast a signed transaction if copied literally. The document explains mechanics and performance but does not warn that these examples can spend funds or have irreversible on-chain effects.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · rpc-methods.md (reported line 29)May include surrounding context.

bash
# Both work identically:
curl -X POST https://mainnet.megaeth.com/rpc \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
80% confidence
Finding

The latency section encourages pre-signing and nonce pipelining for speed, but omits guardrails around stale nonces, accidental replay of queued transactions, and unintended fund movement if pre-signed payloads are reused or sent under changed conditions. In a wallet/developer skill focused on transaction handling, this can lead users to adopt unsafe operational patterns that cause real financial loss or transaction-ordering mistakes.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The example presents a Solana-style blockhash freshness/retry flow inside a MegaETH/EVM security guide, which can mislead developers into implementing incorrect transaction handling assumptions. In a development playbook, contradictory chain semantics are security-relevant because they may cause failed submissions, broken retry logic, or unsafe signing/broadcast workflows based on the wrong threat model.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

Referring to 'CPI targets' in an EVM/MegaETH audit checklist imports Solana terminology that does not match the surrounding platform model, increasing the chance that reviewers misunderstand what should actually be checked. While not an exploit primitive by itself, this kind of cross-ecosystem confusion in security guidance can cause audits to miss real risks around arbitrary external calls and call target validation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · testing.md (reported line 152)May include surrounding context.

bash
# Detailed timing breakdown
curl -i -X POST https://mainnet.megaeth.com/rpc \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"eth_blockNumber","params":[]}' \
  -w "dns: %{time_namelookup} | connect: %{time_connect} | total: %{time_total}\n"

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · wallet-operations.md (reported line 43)May include surrounding context.

bash
# Generate wallet (one-time)
node src/setup.js --json
# Stores key at ~/.evm-wallet.json (chmod 600)

Check Balance

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The example approves maxUint256 without warning about the risks of unlimited ERC20 allowances. If the spender contract is compromised, upgraded maliciously, or incorrectly specified, it can drain all approved tokens from the wallet, and a wallet-operations guide makes this pattern especially likely to be copied directly into production scripts.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · wallet-operations.md (reported line 307)May include surrounding context.

md
## Security Notes

1. **Never expose private keys** — store at `~/.evm-wallet.json` with chmod 600
2. **Confirm before sending** — always show recipient, amount, gas before execution
3. **Use hardware wallets** for large amounts
4. **Verify contract addresses** — check explorer before interacting

Static analysis

No suspicious patterns detected.