ClawHub
Back to skill

Security audit

Pay For Service

Security checks for vulnerabilities and agentic risk

Overview

This skill clearly does paid API calls, but it allows automatic USDC payments without mandatory per-request approval or a spending cap.

Review this carefully before installing. It is not hidden or deceptive, but it can spend USDC through an authenticated wallet. Only use it where you trust the awal CLI source, understand x402 payments, and can enforce your own confirmation and spending limits outside the skill.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:6
Finding

Execution of an Unpinned npm Package Using the Latest Version

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 6-22
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code

yaml
allowed-tools: ["Bash(npx awal@latest status*)", "Bash(npx awal@latest balance*)", "Bash(npx awal@latest x402 pay *)"]
bash
npx awal@latest status
bash
npx awal@latest x402 pay <url> [-X <method>] [-d <json>] [-q <params>] [-h <json>] [--max-amount <n>] [--json]

Technical Analysis

The Skill authorizes and instructs the Agent to invoke awal@latest through npx. The latest tag is mutable, so the package version executed at runtime can differ from the version that existed when the Skill was reviewed. The Skill does not pin a specific reviewed version, enforce a package integrity hash, or otherwise verify the downloaded package.

Because npx can retrieve and execute the selected npm package, compromise of the package publisher account, registry distribution path, or a future malicious release could introduce arbitrary code without requiring changes to this repository. The code would execute with the operating-system permissions and environment available to the Agent process.

Attack Path

  1. An attacker compromises the npm package publisher or causes a malicious release to become the version referenced by the latest tag.
  2. The Agent loads the Skill and runs an allowed command such as npx awal@latest status.
  3. npx resolves and downloads the attacker-controlled package version.
  4. Package lifecycle behavior or command implementation executes with the Agent process's local permissions.
  5. The malicious package can access resources available to that process or manipulate wallet and payment operations.

Impact Assessment

Successful exploitation could permit arbitrary code execution within the privileges of the Agent process. Depending on the runtime environ ...[truncated 328 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace awal@latest with an exact, reviewed package version.
  • Record and verify the package integrity hash through a lockfile or equivalent trusted mechanism.
  • Configure npm to use only an approved registry and validate the expected package publisher and provenance.
  • Disable or strictly control package lifecycle scripts where operationally possible.
  • Install the reviewed dependency during a controlled build step rather than downloading executable code when the Skill is invoked.
  • Run the command in a sandbox with minimal filesystem, environment, wallet, and network access.
  • Establish a dependency update process requiring security review before changing the pinned version.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:22
Finding

Automatic Cryptocurrency Payments Without a Mandatory Spending Cap or Explicit Confirmation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 22-61
Vulnerability Type: Missing safeguards for irreversible financial operations
Risk Level: Medium

Vulnerable Code

bash
npx awal@latest x402 pay <url> [-X <method>] [-d <json>] [-q <params>] [-h <json>] [--max-amount <n>] [--json]
markdown
| `--max-amount <amount>` | Max payment in USDC atomic units (1000000 = $1.00) |
bash
# Make a GET request (auto-pays)
npx awal@latest x402 pay https://example.com/api/weather

# Make a POST request with body
npx awal@latest x402 pay https://example.com/api/sentiment -X POST -d '{"text": "I love this product"}'

# Limit max payment to $0.10
npx awal@latest x402 pay https://example.com/api/data --max-amount 100000

Technical Analysis

The command syntax makes --max-amount optional, and the first two documented examples perform automatic payments without any spending cap. The instructions also do not require the Agent to present the payment amount, recipient, network, and endpoint to the user or obtain explicit confirmation immediately before payment.

An x402 endpoint controls the payment requirements returned for a request. If the endpoint is malicious, compromised, mistyped, redirected, or more expensive than expected, an uncapped invocation could authorize a payment beyond the user's intended amount. The examples reinforce the unsafe default by demonstrating uncapped automatic payment as normal usage.

Attack Path

  1. The Agent receives or discovers an attacker-controlled, compromised, or unexpectedly expensive x402 endpoint.
  2. Following the documented examples, the Agent invokes x402 pay without --max-amount.
  3. The endpoint returns an x402 payment requirement.
  4. The payment tool automatically satisfies the requirement without a Skill-mandated confirmation step or spending ceiling.
  5. USDC is transferred from the ...[truncated 475 chars]
Remediation
View remediation

Remediation Suggestions

  • Require --max-amount for every payment invocation rather than treating it as optional.
  • Set a conservative default ceiling and reject requests where the user has not explicitly approved a higher amount.
  • Before payment, display the normalized endpoint, HTTP method, payment amount, token, network, and recipient.
  • Require explicit user confirmation immediately before executing each irreversible payment.
  • Permit only HTTPS endpoints and validate redirects so payments cannot silently move to an unapproved destination.
  • Consider an allowlist for trusted x402 hosts and enforce per-request, per-session, and daily spending limits.
  • Update every example to include a payment cap and a confirmation step.
  • Log transaction identifiers and approved amounts for review without recording wallet secrets or other sensitive credentials.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill describes automatic USDC payment and immediately instructs use of payment commands, but it does not require an explicit user warning, consent step, or transaction confirmation before funds may be spent. In this context, that is highly dangerous because ambiguous invocation or prompt-driven automation could result in unauthorized financial transactions to arbitrary x402 endpoints.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

A further manifest entry again authorizes mutable npx execution. In a skill whose purpose is to make paid requests, any compromise of the CLI can directly affect financial operations and outbound network activity.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description uses broad triggers such as 'use when you or the user want to call a paid API' and 'pay for an API call,' which can overlap with common user requests. This increases the chance the skill is invoked in contexts where the user did not clearly intend to authorize spending, especially when combined with automatic payment behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

The manifest contains another npx awal@latest reference, again exposing the skill to supply-chain compromise through unpinned package execution. Because these are tool-authorized commands, exploitation could occur through normal skill use without further privilege escalation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

The instructional content tells operators to run npx awal@latest status, reinforcing use of an unpinned package outside the manifest as well. Even if intended only as documentation, users or agents following it would execute mutable code from the package registry.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

The documented command syntax uses npx awal@latest x402 pay, which is especially sensitive because it combines remote package execution with financial actions. A malicious package update could modify payment destination logic, alter request handling, or leak secrets under the guise of normal paid API usage.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The example command again promotes execution of @latest, perpetuating the same supply-chain risk. Repetition in examples increases the chance that future automation or manual operators will normalize unsafe invocation patterns.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

This POST example uses npx awal@latest in a context that may carry user-supplied data and trigger payment. If the package is compromised, both the request payload and payment operation may be manipulated or exfiltrated.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The max-payment example still relies on mutable remote code via @latest. Even with a spending cap, a malicious update could tamper with cap enforcement, falsify displayed amounts, or perform other unauthorized actions in the execution environment.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The prerequisites section references npx awal@latest status, continuing the unsafe pattern. Because prerequisites are often followed before every use, this creates repeated opportunities for executing unreviewed code.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The error-handling guidance instructs use of awal auth login in the same toolchain context, and elsewhere the skill establishes @latest usage. In a wallet-auth flow, executing mutable package code is particularly risky because credentials or auth tokens may be exposed or mishandled.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The balance-check instruction is adjacent to and dependent on the same mutable CLI toolchain. While lower risk than direct payment, compromise here could misreport balances or collect wallet metadata used in later attacks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.