ClawHub
Back to skill

Security audit

Crypto Levels Analyzer

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its crypto-analysis purpose, but it needs review because it writes predictable files in /tmp and includes a packager that can accidentally archive files outside the skill tree through symlinks.

Review before installing. Use it only as a normal, unprivileged user, avoid running it on shared systems if the /tmp files matter, and do not run package_skill.py on an untrusted or modified skill directory. Treat the trading output as educational analysis, not financial advice.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/analyze_levels.py:467
Finding

Predictable Shared Temporary Files Permit Symlink-Based File Overwrite

Content
View full analysis

Vulnerability Details

File Locations:

  • scripts/analyze_levels.py:467-472
  • scripts/analyze_manual.py:220
  • scripts/analyze_quick.py:196
  • scripts/mock_analyzer.py:225

Vulnerability Type: Predictable temporary file usage and symlink-following file write
Risk Level: Medium

Vulnerable Code

python
# Also save as JSON for debugging
try:
    with open("/tmp/crypto_analysis.json", "w") as f:
        json.dump(analysis, f, indent=2, ensure_ascii=False)
except:
    pass

The auxiliary analyzers perform equivalent writes to fixed shared paths:

text
/tmp/crypto_analysis_manual.json
/tmp/crypto_analysis_quick.json
/tmp/crypto_analysis_mock.json

Technical Analysis

The analyzers write debugging results to predictable names in the globally shared /tmp directory. Python's normal open(..., "w") operation follows symbolic links and truncates the destination if it already exists.

On a multi-user system, another local user can create one of these predictable paths as a symbolic link before the analyzer runs. When a victim subsequently invokes the affected script, the write follows that link and replaces the linked file with JSON output, provided that the victim account has permission to write to the target.

This behavior is unnecessary for the Skill's primary function because the analysis is already printed to standard output. The broad except clause also suppresses evidence of failed or redirected debug writes, making the issue harder to detect.

Attack Path

  1. A local attacker predicts which analyzer the victim will execute.
  2. The attacker creates the corresponding path in /tmp as a symbolic link to a file writable by the victim account.
  3. The victim runs the affected analyzer.
  4. The script opens the predictable path in write mode.
  5. The operating system follows the symbolic link and truncates or replaces the linked target with the generated JSON.

...[truncated 789 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the debug-file write from normal execution unless it is explicitly requested by the user.
  2. If temporary output is required, use tempfile.NamedTemporaryFile or tempfile.mkstemp so the file is created atomically with an unpredictable name.
  3. Store persistent output in a user-private application directory rather than globally shared /tmp.
  4. Create output with restrictive permissions, such as mode 0600.
  5. If a stable filename is unavoidable, use safe exclusive creation and reject symbolic links, including platform-appropriate O_NOFOLLOW and O_EXCL protections.
  6. Apply the same correction to all four affected analyzers.
  7. Replace the bare except clause with specific exception handling and report write failures to the caller.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/package_skill.py:131
Finding

Skill Packager Can Include Files Outside the Project Through Symbolic Links

Content
View full analysis

Vulnerability Details

File Location: scripts/package_skill.py:131-137
Vulnerability Type: Symlink-based unintended file inclusion
Risk Level: Medium

Vulnerable Code

python
# Add resource directories
for resource in ['scripts', 'references', 'assets']:
    resource_dir = skill_path / resource
    if resource_dir.exists():
        for file_path in resource_dir.rglob('*'):
            if file_path.is_file():
                arcname = file_path.relative_to(skill_path)
                zipf.write(file_path, arcname)

Technical Analysis

The packaging routine recursively enumerates resource directories and adds every object for which Path.is_file() returns true. That check follows symbolic links. The code does not reject symlinks, resolve each candidate to its canonical location, or verify that the resolved target remains under the intended Skill root.

Consequently, a symbolic link located under scripts, references, or assets can point to a readable file outside the project. zipf.write() then reads the external target and stores its contents in the generated .skill archive under the symlink's project-relative name.

This is a packaging-time disclosure issue rather than archive path traversal: the archive member name remains relative to the project, but its content can originate from outside the project boundary.

Attack Path

  1. An attacker gains the ability to modify a project tree that a trusted user will package, or supplies a prepared project tree containing a malicious symbolic link.
  2. The attacker places a link under scripts, references, or assets that points to a sensitive file readable by the packaging user.
  3. The trusted user runs python3 scripts/package_skill.py against that tree.
  4. rglob() discovers the link and is_file() accepts it because its target is a regular file.
  5. zipf.write() reads the external target and embeds its contents in the `. ...[truncated 661 chars]
Remediation
View remediation

Remediation Suggestions

  1. Reject every candidate for which file_path.is_symlink() is true.
  2. Resolve the Skill root and each candidate with Path.resolve().
  3. Verify that every resolved candidate remains beneath the resolved Skill root before opening it.
  4. Apply the containment check immediately before reading the file to reduce time-of-check/time-of-use exposure.
  5. Package only an explicit allowlist of expected files where practical.
  6. Run release packaging under a minimally privileged account without access to unrelated secrets.
  7. Add automated tests containing symlinks to files both inside and outside the project and require the packager to reject them.
  8. Fail packaging with a clear error when a symlink or out-of-root path is encountered rather than silently including or skipping unexpected content.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (20)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared function is cryptocurrency analysis, but the detected behavior includes skill packaging, validation, filesystem traversal, and file archiving. Hidden filesystem traversal and archive creation expand the attack surface beyond the user-facing purpose and can expose local files or package unintended content if invoked in an agent environment.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared function is cryptocurrency analysis, but the detected behavior includes skill packaging, validation, filesystem traversal, and file archiving. Hidden filesystem traversal and archive creation expand the attack surface beyond the user-facing purpose and can expose local files or package unintended content if invoked in an agent environment.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file appears to require Chinese for all user-facing instructions and examples, including the title and all operational guidance. Under the policy rule, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is clearly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation explicitly advertises '完整的中文界面' as a feature, and the usage examples throughout the README are exclusively in Chinese. This indicates a language-specific constraint without any stated opt-in, alternative locale, or explanation that the skill is intentionally region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file contains natural-language claims that the skill provides a Chinese interface as a product highlight. Because the document does not mention any user-selectable language option or justify a locale restriction, it appears to enforce a specific language without opt-in, which matches the language/locale policy violation criterion.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
79% confidence
Finding

The skill documentation declares no explicit tool scope, yet the analyzed capability set indicates file read, file write, and network access. Undeclared capabilities are dangerous because they prevent reviewers and operators from understanding the real execution boundary, and file/network access can be abused for data exfiltration, unauthorized persistence, or unexpected side effects.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill description and examples prominently instruct and demonstrate use in Chinese, including user prompts and generated responses, but do not state that the skill is Chinese-only or provide an opt-in choice of language. This can violate language/locale policy because it implicitly forces a specific language experience without user selection or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file forces a specific language/locale for all users via the title and the rest of the document content. Under the policy, language constraints should offer user choice or be clearly documented as region-specific and justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Multiple example queries are written in Chinese, and later sections continue to present query formats oriented to Chinese users. Because this is natural-language guidance in a generally applicable reference file, it effectively biases usage toward a specific language without documenting user choice or a justified locale restriction.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · USAGE_GUIDE.md (reported line 334)May include surrounding context.

md
def __init__(self, data_source="coingecko"):
        self.data_source = data_source
        self.base_urls = {
            "coingecko": "https://api.coingecko.com/api/v3",
            "binance": "https://api.binance.com/api/v3",
            "coinmarketcap": "https://pro-api.coinmarketcap.com/v1"
        }

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/analyze_levels.py (reported line 20)May include surrounding context.

python
def __init__(self, data_source="coingecko"):
        self.data_source = data_source
        self.base_urls = {
            "coingecko": "https://api.coingecko.com/api/v3",
            "binance": "https://api.binance.com/api/v3",
            "coinmarketcap": "https://pro-api.coinmarketcap.com/v1"
        }

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · USAGE_GUIDE.md (reported line 333)May include surrounding context.

md
self.data_source = data_source
        self.base_urls = {
            "coingecko": "https://api.coingecko.com/api/v3",
            "binance": "https://api.binance.com/api/v3",
            "coinmarketcap": "https://pro-api.coinmarketcap.com/v1"
        }
        self.base_url = self.base_urls.get(data_source, self.base_urls["coingecko"])

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/analyze_levels.py (reported line 21)May include surrounding context.

python
self.data_source = data_source
        self.base_urls = {
            "coingecko": "https://api.coingecko.com/api/v3",
            "binance": "https://api.binance.com/api/v3",
            "coinmarketcap": "https://pro-api.coinmarketcap.com/v1"
        }
        self.base_url = self.base_urls.get(data_source, self.base_urls["coingecko"])

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

This Python file contains user-facing natural-language output and guidance entirely in Chinese, including headings, analysis labels, trading suggestions, and the final risk notice. Because the skill does not offer the user any language selection or indicate that it is intentionally limited to a Chinese-speaking context, it violates the language/locale policy for natural-language behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The module description states the skill is for manual input mode in Chinese, and the script's user-facing prompts and output are also written in Chinese. This imposes a specific language on users without any opt-in, fallback, or documented reason that the tool must be Chinese-only.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

This code emits the main user-facing analysis, trading guidance, and risk notices in Chinese string literals. Because the file provides no user opt-in, language selection, or justification for a Chinese-only locale, it violates the policy against forcing a specific language without user choice.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The manifest describes an analysis skill that provides current price, support/resistance levels, and technical insights. In addition to that analysis, the code persists results to /tmp/crypto_analysis.json, which is a side effect not suggested by the manifest and not necessary to deliver the described functionality.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The manifest describes an analysis skill that provides current price, key levels, and trading insights, which implies computation and presentation of results. In this file, the script additionally persists the analysis to /tmp/crypto_analysis_manual.json, introducing local file-write behavior not suggested by the manifest description.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest frames this skill as providing cryptocurrency support/resistance analysis and trading insights. In addition to producing analysis, the script persists results to /tmp/crypto_analysis_quick.json, which is a side effect not indicated by the description and not necessary to the stated analytical purpose.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest describes a skill that analyzes crypto support/resistance levels and provides price and trading insights, which implies computation and result delivery, not local persistence. This script additionally saves analysis JSON to /tmp for debugging, adding behavior outside the stated analysis-only scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.