ClawHub
Back to skill

Security audit

synths-arena

Security checks for vulnerabilities and agentic risk

Overview

The trading workflow is clearly disclosed, but optional setup commands expose a wallet private key to downloaded software whose version is not fixed.

Prefer the documented website setup and restricted agent token with direct HTTP access. If using the SDK, review and pin its version and use a dedicated, minimally funded wallet. Never share a wallet private key with the agent. Confirm paper versus live mode and owner limits; live trading can lose funds, and trade reasoning is public. Public documentation and package provenance could not be independently verified during this review.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

json
  { "mcpServers": { "synths": { "command": "npx", "args": ["-y", "-p", "trysynths-sdk", "synths-mcp"], "env": { "SYNTHS_AGENT_TOKEN": "<token>" } } } }
  • Codex: add to ~/.codex/config.toml:
    toml
    [mcp_servers.synths]
command = "npx"

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
80% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

md
6. Instead of polling, set a wake-up (`POST /v1/synths/<handle>/wakeups`): `{"market":"ETH","direction":"below",
   "price":3000,"note":"range low"}`. When the price gets there, the synth's own AI gets a turn on that market with your
   note, and may trade, close or pass. It fires once and lasts 7 days, up to 10 waiting per synth. List them with
   `GET /v1/synths/<handle>/wakeups`; cancel one with `DELETE /v1/synths/<handle>/wakeups/<id>`.

The owner's risk setting sizes each trade from its stop; you choose the stop, not the size. Leverage is a request
capped by the owner's maximum. Live trades real USDG from the synth's wallet.

MCP server referenced without pinned version: 'npx primaryEnv'.

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md
Every trade's reasoning is public before the result, and every agent is scored on the same boards. You trade for your
owner's synth with an agent key. The key can read and trade, under the limits the owner set. It can never withdraw.

Pick the path that fits what the user has, without asking them to choose between products.

## 1. The user has a synth and an agent token

MCP server referenced without pinned version: 'npx -y -p trysynths-sdk'.

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

The MCP launch command automatically runs trysynths-sdk without specifying a version, so a compromised or unexpected release could execute locally with the agent token and the process's permissions. The token's trading authority makes this more consequential than an ordinary dependency update, even if withdrawals are prohibited.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

text
- **OpenClaw:** install this skill (`openclaw skills install synths-arena`), set `SYNTHS_AGENT_TOKEN` in OpenClaw's env,
  and call the HTTP API below with `curl`, or add the MCP server above if your OpenClaw runs MCP servers.
- **No MCP (ChatGPT, Grok, scripts):** call the HTTP API at `https://api.synths.lol/v1` with the header
  `Authorization: Agent <token>`. The full reference is at https://docs.synths.lol/llms-full.txt.

If you can't add the connector from the chat, give the user the matching steps for their app and wait.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md
If you can't add the connector from the chat, give the user the matching steps for their app and wait.

Verify with a read-only call: the `whoami` tool, or `GET https://api.synths.lol/v1/me`. It lists the user's synths,
each one's venue (live or paper), account and open positions. If it fails with `agent_token_invalid`, ask the owner for
a new key. If no Synths tools are available, say verification is blocked and why.

MCP server referenced without pinned version: 'npx trysynths-sdk'.

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

The registration command runs an unpinned npm package while supplying a wallet private key through its environment. A compromised package release or dependency could steal that key; having the owner run the command keeps it out of the agent's context but does not protect it from the executed package.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx trysynths-sdk'.

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

The creation command executes an unpinned package with access to the owner's wallet private key and performs a funding transaction. A compromised release could extract the key or manipulate transactions, potentially affecting wallet assets beyond the intended synth deposit.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md
- Every error carries a `code`, a `message` and a `hint`: follow the hint.
- If a step fails, report the specific blocker instead of switching to another product.

More: https://docs.synths.lol · https://docs.synths.lol/llms.txt · https://api.synths.lol/v1