ClawHub
Back to skill

Security audit

Axon Agent

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to do what it claims, but it handles wallet private keys, irreversible on-chain transactions, and persistent background services without enough safeguards.

Review before installing. Use a dedicated low-funds wallet, prefer address-only status checks, protect the private-key file tightly, verify the Axon repo and dependency versions yourself, run dry-run first, and do not execute real registration unless you accept the permanent burn, stake lockup, and persistent daemon/cron behavior.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:66
Finding

Unpinned Remote Dependencies and Mutable Source Build

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/check-status.py:31
Finding

Read-Only Status Check Unnecessarily Loads the Wallet Private Key

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/register.py:82
Finding

Registration Proceeds After Preflight Safety Checks Fail

Content
View full analysis
Remediation
View remediation

T06 · System Persistence

Warning
Location
scripts/watchdog.sh:2
Finding

Cron-Based Daemon Persistence Is Non-Idempotent and Uses an Ambiguous Process Check

Content
View full analysis
/dev/null; echo '*/5 * * * * /opt/axon/watchdog.sh') | crontab -" ``` ```bash #!/bin/bash # Axon agent-daemon watchdog — run via cron: */5 * * * * /opt/axon/watchdog.sh # Usage: Set AXON_DIR, PRIVATE_KEY, and RPC below, then: crontab -e → add line above AXON_DIR="${AXON_DIR:-/opt/axon}" DAEMON="$AXON_DIR/tools/agent-daemon/agent-daemon" PK_FILE="$AXON_DIR/private_key.txt" RPC="${AXON_RPC:-https://mainnet-rpc.axonchain.ai/}" LOG="$AXON_DIR/watchdog.log" if ! pgrep -f "agent-daemon" > /dev/null 2>&1; then echo "$(date '+%Y-%m-%d %H:%M:%S') [RESTART] daemon not running" >> "$LOG" nohup "$DAEMON" \ --rpc "$RPC" \ --private-key-file "$PK_FILE" \ --heartbeat-interval 720 \ --log-level info \ >> "$AXON_DIR/daemon.log" 2>&1 & echo "$(date '+%Y-%m-%d %H:%M:%S') [RESTART] new PID: $!" >> "$LOG" else echo "$(date '+%Y-%m-%d %H:%M:%S') [OK] daemon running" >> "$LOG" fi ``` ### Technical Analysis The persistence mechanism is disclosed and directly supports the declared requirement to maintain periodic blockchain heartbeats. It is therefore not a hidden backdoor. However, its implementation has several security and reliability weaknesses: - Re-running the installation command appends duplicate cron entries. - No uninstall or cleanup procedure is supplied. - `pgrep -f "agent-daemon"` matches any process whose full command line contains that text, rather than the intended executable and instance. - The watchdog executes fixed files ...[truncated 1789 chars]
Remediation
View remediation
/exe` resolves to the expected binary. 7. Require `/opt/axon`, the watchdog, the daemon, and key file to have restrictive ownership and permissions. 8. Verify daemon integrity before execution, such as with a pinned checksum. 9. Rotate logs to prevent indefinite disk consumption. 10. Isolate signing credentials from the general daemon process where technically possible. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · scripts/register.py (reported line 5)May include surrounding context.

python
"""
Axon Agent Registration Script
Bypasses the official SDK due to ABI mismatch (see references/known-issues.md).
Usage: python3 register.py --private-key-file /path/to/key.txt --capabilities "nlp,coding" --model "claude-sonnet-4.6"
"""
import argparse
import sys

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The README instructs users to provide a private key file directly to local scripts, but it does not include any warning about secure storage, file permissions, shell history, or the risk of exposing wallet credentials. In a blockchain context, compromise of the private key would allow full control of the wallet and loss of staked or liquid funds, so normalizing this workflow without safety guidance materially increases credential-handling risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill directs users to store an EVM private key in a local file and then pass that file to scripts and a long-running daemon, but it lacks a strong secret-handling warning. This increases the risk of credential theft through file leakage, shell history, backups, logs, permissive ownership, or compromise of the host running the daemon.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

md
## Prerequisites

- Server with Python 3.8+ and Go 1.21+
- EVM wallet private key saved to a file (e.g. `/opt/axon/private_key.txt`, chmod 600)
- Minimum 120 AXON balance (100 stake + 20 burn + gas buffer)
- `web3` Python package: `pip install web3`

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill instructs the user to perform an on-chain registration that stakes 100 AXON and notes that 20 AXON is burned permanently, but it does not present a clear warning/consent step immediately before the irreversible transaction. Because blockchain transactions are final, users may unintentionally incur permanent financial loss if they follow the instructions without understanding the consequences.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
83% confidence
Finding

The skill starts a background daemon with nohup, creating a process that persists beyond the interactive session and continuously uses the wallet key for heartbeats. While operationally necessary for this blockchain agent, background persistence increases exposure if the host is compromised or if the daemon/binary is replaced or misconfigured.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

md
go build -o tools/agent-daemon/agent-daemon ./tools/agent-daemon/

# Start daemon
nohup /opt/axon/tools/agent-daemon/agent-daemon \
  --rpc https://mainnet-rpc.axonchain.ai/ \
  --private-key-file /opt/axon/private_key.txt \
  --heartbeat-interval 720 \

Session Persistence

Medium
Category
Rogue Agent
Confidence
86% confidence
Finding

The skill installs a recurring cron job on a remote server, which creates persistence by automatically executing a script every five minutes. In legitimate admin context this may be intended, but from a security perspective persistence mechanisms are sensitive because they can survive session termination and repeatedly run modified or compromised scripts.

Content

Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.

ssh user@YOUR_SERVER "chmod +x /opt/axon/watchdog.sh"

Add cron (every 5 min)

ssh user@YOUR_SERVER "(crontab -l 2>/dev/null; echo '*/5 * * * * /opt/axon/watchdog.sh') | crontab -"

text

---

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code accesses a highly sensitive credential by reading a private key from a user-supplied file and deriving an address from it. Although the file usage is visible in the CLI argument, there is no confirmation prompt, warning print, or comment/docstring explaining the sensitivity of this operation or advising safe handling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

Several user-facing strings are hardcoded in Chinese, which imposes a specific language on users without offering a language choice or documenting that the tool is intended only for a Chinese-speaking context. This matches the policy category for language or locale restrictions without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This code prints multiple user-facing messages in Chinese, including balance, errors, warnings, and success notices. Because the script does not provide a locale option or document a justified region-specific constraint, it forces a specific language on users and violates the language/locale policy criterion.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/watchdog.sh (reported line 3)May include surrounding context.

sh
#!/bin/bash
# Axon agent-daemon watchdog — run via cron: */5 * * * * /opt/axon/watchdog.sh
# Usage: Set AXON_DIR, PRIVATE_KEY, and RPC below, then: crontab -e → add line above

AXON_DIR="${AXON_DIR:-/opt/axon}"
DAEMON="$AXON_DIR/tools/agent-daemon/agent-daemon"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script starts a long-running daemon with a private key file from disk, but provides no safeguards around secret storage, permissions, or operator warnings. In this context, the daemon appears to be an agent connected to an external RPC endpoint, so compromise of the key file or accidental insecure deployment could expose credentials used for blockchain or agent identity operations.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
65% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/watchdog.sh (reported line 13)May include surrounding context.

sh
if ! pgrep -f "agent-daemon" > /dev/null 2>&1; then
    echo "$(date '+%Y-%m-%d %H:%M:%S') [RESTART] daemon not running" >> "$LOG"
    nohup "$DAEMON" \
        --rpc "$RPC" \
        --private-key-file "$PK_FILE" \
        --heartbeat-interval 720 \