ClawHub
Back to skill

Security audit

Crypto Watcher

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed crypto wallet monitoring CLI that uses public wallet data and third-party blockchain APIs, with notable dependency and privacy caveats but no evidence of hidden or malicious behavior.

This skill is reasonable to install if you are comfortable sharing watched public wallet addresses with the listed RPC providers and related crypto APIs. Prefer an updated release that pins dependencies and moves ws to a patched version, and do not use it with private keys, seed phrases, or wallets whose monitoring activity you need to keep private.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Known Vulnerable Dependency: ws==8.18.3 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High
Category
Supply Chain
Confidence
94% confidence
Finding

The lockfile pins the transitive dependency ws to version 8.18.3, and the finding cites published advisories for uninitialized memory disclosure and memory-exhaustion denial of service in that exact version. Because viem can use WebSocket connectivity, a vulnerable ws in a network-facing crypto watcher increases exposure to malicious or malformed remote traffic that could crash the process or leak memory contents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Wallet addresses are sent to third-party RPC providers and external services as part of normal operation without any explicit notice, consent, or privacy controls. Although blockchain addresses are public, aggregating a user's watched wallets and querying them through centralized providers can expose monitoring habits, correlate identities, and leak portfolio interest to external operators.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · src/cli.js (reported line 100)May include surrounding context.

js
// Get prices from CoinGecko
async function getPrices() {
  try {
    const res = await fetch('https://api.coingecko.com/api/v3/simple/price?ids=ethereum,usd-coin,tether&vs_currencies=usd');
    const data = await res.json();
    return {
      ETH: data.ethereum?.usd || 0,

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The comment and function name at L113-L126 indicate the function retrieves DeFi positions for a wallet address, yet it calls https://api.llama.fi/protocol/${address}, which is not a per-wallet position lookup, and the function is never used by the CLI command. Separately, the defi command at L252-L260 says it is checking DefiLlama but actually fetches a generic historical chain TVL endpoint and then only suggests external sites, which materially contradicts the stated intent of checking wallet DeFi positions.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

This code transmits the user-supplied wallet address to DefiLlama-related endpoints without clear disclosure or opt-in. Even though the address is public on-chain, querying third-party APIs about a user's tracked addresses can leak sensitive profiling information and create unnecessary exposure to external analytics providers.

Content

Scanner excerpt · src/cli.js (reported line 116)May include surrounding context.

js
// Get DeFi positions from DefiLlama
async function getDefiPositions(address) {
  try {
    const res = await fetch(`https://api.llama.fi/protocol/${address}`);
    if (!res.ok) {
      // Try alternative endpoint
      const altRes = await fetch(`https://coins.llama.fi/prices/current/ethereum:${address}`);

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · src/cli.js (reported line 256)May include surrounding context.

js
console.log('  Checking DefiLlama...');
  
  try {
    const res = await fetch(`https://api.llama.fi/v2/historicalChainTvl`);
    // DefiLlama doesn't have per-address API, suggest alternatives
    console.log('\n  💡 For detailed DeFi positions, check:');
    console.log(`     • https://debank.com/profile/${address}`);

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency uses a caret range (^2.0.0), which allows installation of newer minor and patch releases that were not explicitly reviewed by the skill author. This creates supply-chain risk because a compromised upstream release or breaking change could be pulled into future installs, and this crypto-focused tool likely interacts with wallet and DeFi data where dependency trust matters.

Content

Scanner excerpt · package.json (reported line 17)May include surrounding context.

json
"author": "Elonito",
  "license": "MIT",
  "dependencies": {
    "viem": "^2.0.0"
  }
}

Static analysis

No suspicious patterns detected.