ClawHub
Back to skill

Security audit

Etherscan

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Etherscan lookup helper, with the main cautions being local API-key storage and sending lookup queries to Etherscan.

Install only if you are comfortable letting the agent query Etherscan with wallet addresses, transaction hashes, and an Etherscan API key. Prefer an environment variable or a credential manager if you do not want a plaintext key persisted under ~/.config/etherscan.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:20
Finding

Mandatory Third-Party Branding Alters Agent Responses

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 20
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Medium

Complete Code Snippet:

markdown
| **Citation**   | End with "Powered by Etherscan" — required.         |

Technical Analysis

The Skill contains an unconditional instruction requiring the agent to append a fixed third-party promotional phrase to its output. This requirement is unrelated to the technical operation needed to query the Etherscan API and affects the agent's user-facing response behavior whenever the Skill is loaded.

Because the instruction is presented as mandatory, it can override the user's expected control over response content. Although it does not disable safety controls or grant system access, it demonstrates instruction hijacking by imposing attacker-selected output that persists throughout the current Skill session.

Attack Path

  1. The agent loads SKILL.md to perform an Etherscan-related query.
  2. The mandatory citation rule becomes part of the agent's active instructions.
  3. The agent performs the otherwise legitimate API lookup.
  4. Regardless of whether attribution was requested, the agent appends Powered by Etherscan to its response.
  5. The resulting answer contains third-party branding selected by the Skill author rather than by the user.

Impact Assessment

The issue can influence user-visible responses generated while this Skill is active. It does not provide filesystem, operating-system, credential, or network privileges beyond those already required by the Skill. Its scope is limited to response-content manipulation, but it may create misleading endorsement, compromise output neutrality, and establish a pattern that could be expanded into more intrusive session-level instructions.

The audit also reviewed the dedicated credential path at SKILL.md:27-39 and network requests at SKILL.md:45 and SKILL.md:101-133. The API ...[truncated 297 chars]

Remediation
View remediation

Remediation Suggestions

Remove the unconditional branding requirement. Attribution should be included only when required by an applicable service policy, requested by the user, or necessary to identify the source of returned data.

If attribution is genuinely required, harden the instruction as follows:

  1. State the precise policy or contractual basis for attribution.
  2. Limit attribution to responses containing data obtained from Etherscan.
  3. Do not require promotional wording for unrelated responses.
  4. Use neutral source metadata such as Source: Etherscan rather than mandatory promotional prose.
  5. Explicitly preserve higher-priority system, developer, and user instructions.
  6. Keep attribution separate from substantive results so downstream consumers can omit or render it appropriately.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (13)

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

The skill explicitly instructs the agent to read credentials from a local file or environment variable, which is sensitive secret access. In a skill-execution environment, this can overreach least-privilege boundaries and cause unintended secret exposure if the skill is invoked in untrusted contexts or if outputs/logs accidentally reveal the key.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md
## Step 0: Get API Key (If Needed)

Try sources in order:
1. **Credentials file** — `~/.config/etherscan/credentials.json` → `{"api_key":"..."}`
2. **Environment variable** — `$ETHERSCAN_API_KEY`
3. **Ask user** (last resort) — acknowledge receipt, don't echo it

Credential Access

High
Category
Privilege Escalation
Confidence
91% confidence
Finding

The instructions tell the agent to create and populate a persistent credentials file containing the API key. Persisting secrets to disk increases exposure through filesystem compromise, backup leakage, accidental inclusion in support bundles, or later misuse by other tools/processes.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

Save it:

bash
mkdir -p ~/.config/etherscan
cat > ~/.config/etherscan/credentials.json << 'EOF'
{"api_key":"USER_KEY_HERE"}
EOF
chmod 600 ~/.config/etherscan/credentials.json

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

Although chmod 600 reduces risk, this line remains part of a workflow that stores a live API credential in a plaintext file on disk. The danger is not the permission change itself but normalizing local secret persistence without stronger secret-handling controls.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

cat > ~/.config/etherscan/credentials.json << 'EOF' {"api_key":"USER_KEY_HERE"} EOF chmod 600 ~/.config/etherscan/credentials.json

text

---

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md
|                |                                                     |
| -------------- | --------------------------------------------------- |
| **Base URL**   | `https://api.etherscan.io/v2/api`                   |
| **Auth**       | `?apikey={key}` query param                         |
| **Rate limit** | ~5/second (free tier). Exceed → `message=NOTOK`     |
| **Citation**   | End with "Powered by Etherscan" — required.         |

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md
|                |                                                     |
| -------------- | --------------------------------------------------- |
| **Base URL**   | `https://api.etherscan.io/v2/api`                   |
| **Auth**       | `?apikey={key}` query param                         |
| **Rate limit** | ~5/second (free tier). Exceed → `message=NOTOK`     |
| **Citation**   | End with "Powered by Etherscan" — required.         |

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

md
|                |                                                     |
| -------------- | --------------------------------------------------- |
| **Base URL**   | `https://api.etherscan.io/v2/api`                   |
| **Auth**       | `?apikey={key}` query param                         |
| **Rate limit** | ~5/second (free tier). Exceed → `message=NOTOK`     |
| **Citation**   | End with "Powered by Etherscan" — required.         |

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

md
|                |                                                     |
| -------------- | --------------------------------------------------- |
| **Base URL**   | `https://api.etherscan.io/v2/api`                   |
| **Auth**       | `?apikey={key}` query param                         |
| **Rate limit** | ~5/second (free tier). Exceed → `message=NOTOK`     |
| **Citation**   | End with "Powered by Etherscan" — required.         |

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

md
|                |                                                     |
| -------------- | --------------------------------------------------- |
| **Base URL**   | `https://api.etherscan.io/v2/api`                   |
| **Auth**       | `?apikey={key}` query param                         |
| **Rate limit** | ~5/second (free tier). Exceed → `message=NOTOK`     |
| **Citation**   | End with "Powered by Etherscan" — required.         |

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

md
|                |                                                     |
| -------------- | --------------------------------------------------- |
| **Base URL**   | `https://api.etherscan.io/v2/api`                   |
| **Auth**       | `?apikey={key}` query param                         |
| **Rate limit** | ~5/second (free tier). Exceed → `message=NOTOK`     |
| **Citation**   | End with "Powered by Etherscan" — required.         |

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.

md
|                |                                                     |
| -------------- | --------------------------------------------------- |
| **Base URL**   | `https://api.etherscan.io/v2/api`                   |
| **Auth**       | `?apikey={key}` query param                         |
| **Rate limit** | ~5/second (free tier). Exceed → `message=NOTOK`     |
| **Citation**   | End with "Powered by Etherscan" — required.         |

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

md
|                |                                                     |
| -------------- | --------------------------------------------------- |
| **Base URL**   | `https://api.etherscan.io/v2/api`                   |
| **Auth**       | `?apikey={key}` query param                         |
| **Rate limit** | ~5/second (free tier). Exceed → `message=NOTOK`     |
| **Citation**   | End with "Powered by Etherscan" — required.         |

Session Persistence

Medium
Category
Rogue Agent
Confidence
89% confidence
Finding

The skill directs creation of a persistent configuration directory and credentials file under the user's home directory, establishing session-to-session retention of a secret. Persistent storage broadens the attack surface because the credential survives beyond the immediate task and may be accessed later by unrelated processes, users, or compromised components.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

Save it:

bash
mkdir -p ~/.config/etherscan
cat > ~/.config/etherscan/credentials.json << 'EOF'
{"api_key":"USER_KEY_HERE"}
EOF

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

cat > ~/.config/etherscan/credentials.json << 'EOF' {"api_key":"USER_KEY_HERE"} EOF chmod 600 ~/.config/etherscan/credentials.json

text

---