ClawHub
Back to skill

Security audit

Aavegotchi Traits

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent read-only Aavegotchi lookup skill with disclosed public network calls and dependency hygiene risks, but no evidence of hidden, destructive, or deceptive behavior.

Before installing, expect the skill to install npm packages and make public network requests to Base RPC and Goldsky using the gotchi ID or name you provide. Use deterministic installs such as npm ci, consider updating the ethers/ws dependency chain, and avoid pointing the environment variables at endpoints that require secrets unless you understand what the endpoint logs.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The documented behavior claims targeted retrieval by gotchi ID or name and broad trait output, but the analyzed implementation reportedly enumerates tokens and returns narrower diagnostic data instead. This mismatch is dangerous because users and higher-level agents may rely on the declared semantics when making automation decisions, leading to unintended data access patterns, excessive network usage, incorrect outputs, and trust in results that do not match the requested asset.

Known Vulnerable Dependency: ws==8.17.1 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High
Category
Supply Chain
Confidence
96% confidence
Finding
The lockfile pins a transitive dependency on ws 8.17.1, and the supplied advisories indicate that this version is affected by uninitialized memory disclosure and memory-exhaustion denial of service issues. Even though this skill appears focused on reading NFT data rather than exposing an obvious WebSocket server directly, ethers can use ws for provider connectivity, so a vulnerable WebSocket code path may be reachable if the skill connects to attacker-controlled or hostile endpoints.

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill advertises executable behavior that uses environment variables and network access, but it does not declare any explicit tool scope or permissions. This creates an authorization and review gap: operators cannot easily tell what capabilities the skill requires, and a permissive runtime could allow broader-than-expected external access or secret exposure through environment-backed configuration.

External Transmission

Medium
Category
Data Exfiltration
Content
const AAVEGOTCHI_CONTRACT = '0xa99c4b08201f2913db8d28e71d020c4298f29dbf';
const DEFAULT_BASE_RPC = 'https://mainnet.base.org';
const DEFAULT_SUBGRAPH_URL =
  'https://api.goldsky.com/api/public/project_cmh3flagm0001r4p25foufjtt/subgraphs/aavegotchi-core-base/prod/gn';

const BASE_RPC = process.env.AAVEGOTCHI_RPC_URL || DEFAULT_BASE_RPC;
const SUBGRAPH_URL = process.env.AAVEGOTCHI_SUBGRAPH_URL === ''
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"description": "Scripts for fetching Aavegotchi traits data",
  "type": "module",
  "dependencies": {
    "ethers": "^6.11.1",
    "node-fetch": "^3.3.2"
  }
}
Confidence
93% confidence
Finding
The dependency uses a caret range (^6.11.1), which allows future non-major versions of ethers to be installed. This can introduce supply-chain risk and non-reproducible builds if an upstream release is compromised or breaks expected behavior, though the impact here is limited because this is a simple package manifest for NFT data retrieval scripts.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"type": "module",
  "dependencies": {
    "ethers": "^6.11.1",
    "node-fetch": "^3.3.2"
  }
}
Confidence
93% confidence
Finding
The dependency uses a caret range (^3.3.2), so installs may pull newer matching versions of node-fetch over time. That creates a supply-chain and reproducibility risk if a later upstream package version is malicious or introduces unexpected behavior, although the surrounding skill context does not make this especially sensitive.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/get-gotchi.js:21