T09 · Insecure Skill Coding Practices
Error
- Location
scripts/channel.sh:55- Finding
Financial Transaction Submission Without Ownership Validation
- Content
View full analysis
- Remediation
View remediation
Security audit
Gotchi Channeling
Security checks for vulnerabilities and agentic risk
Overview
The skill is purpose-built for Aavegotchi automation, but it needs Review because it can submit unattended Bankr wallet transactions while overstating ownership protections and allowing under-scoped transaction settings.
Review carefully before installing. Use an explicit BANKR_API_KEY, verify every parcel/gotchi pair yourself, keep the contract and chain pinned to the intended Base REALM deployment, and avoid cron automation until you have dry-run or confirmation safeguards and transaction monitoring in place.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/lib.sh:29- Finding
Configurable Transaction Destination and Chain Are Not Restricted to the Declared Deployment
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (18)
YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]
High
- Category
- YARA Match
- Confidence
- 75% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
ow to Use
Manual Single Channel
bash cd ~/.openclaw/workspace/skills/gotchi-channeling ./scripts/channel.sh 9638 867Check Cooldown
bash ./scripts/check-cooldown.sh 9638 # Output: ready:0 (or waiting:SECONDS)Channel All Configured Gotchis
bash ./scripts/channel-all.sh # Reads config.json, channels all ready gotchisDaily Automation (Cron)
bash # Add to crontab 0 9 * * * cd ~/.openclaw/workspace/skills/gotchi-channeling && ./scripts/channel-all.sh >> /tmp/channeling.log 2>&1
📊 Performance
Gas Cost:
569,556 gas ($0.02 on Base)
Execution Time: ~3-5 seconds
Rewards: ~250 Alchemica tokens per channel
Cooldown: 24 hours
Automation: Fully autonomous ✅
🔐 Security
- ✅ No private keys - Uses Bankr API only
- ✅ No signature API - Not needed (param ignored)
- ✅ Read-only checks - Cooldown queries are safe
- ✅ Transaction logging - Full audit trail
- ✅ **Secure wallet
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The code partially matches the description because it does check cooldown status for a Gotchi. However, the declared purpose claims a broader capability: channeling Aavegotchis via Bankr, building calldata, and submitting channel transactions safely. This code chunk only performs a read-only RPC query against the Realm Diamond contract and computes remaining cooldown time locally. There is no calldata construction, no Bankr integration, and no transaction submission logic in the supplied code. Therefore the description overstates what this code chunk actually does.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The documentation explicitly states the skill cannot perform autonomous channeling because a backend signature is required, yet the skill metadata claims it channels Aavegotchis and submits transactions safely. This mismatch can mislead users and downstream agents into attempting unsupported or unsafe transaction flows, increasing the chance of failed transactions, unsafe workarounds, or trust in capabilities the skill does not actually have.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
3. Bankr Works Perfectly
Direct transaction submission via Bankr API:
bash curl -X POST "https://api.bankr.bot/agent/submit" \ -H "X-API-Key: $API_KEY" \ -d '{"transaction": {...}}'
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The deployment guide recommends adding a daily cron job that runs the channeling script, but it does not place a prominent warning near the command that this will submit real on-chain transactions automatically. In a blockchain skill, silent scheduled execution can cause repeated spending of gas and repeated state-changing actions without the operator fully appreciating the financial consequences.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 95% confidence
- Finding
The crontab entry establishes persistent scheduled execution of a script that performs real blockchain actions. Even though persistence is not inherently malicious here, it increases risk because a misconfiguration, compromised script, or unnoticed config change could trigger unattended transactions indefinitely.
- Content
Daily Automation (Cron)
bash # Add to crontab 0 9 * * * cd ~/.openclaw/workspace/skills/gotchi-channeling && ./scripts/channel-all.sh >> /tmp/channeling.log 2>&1
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The README explicitly describes scripts that submit wallet-backed blockchain transactions, but it does not clearly warn users that running these commands can cause on-chain state changes, spend gas, and trigger irreversible actions. In an automation skill that batches channeling operations, lack of prominent transaction/effect disclosure increases the risk of users executing value-bearing actions without informed consent or sufficient review.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The release notes explicitly encourage unattended cron-based execution of blockchain transactions but do not pair that guidance with a clear warning about transaction, asset, gas, and configuration risks. In a skill that submits on-chain actions against user-owned assets, this omission can lead users to deploy automation without understanding that misconfiguration or logic errors may cause repeated unwanted transactions or financial loss.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation presents parcel ownership verification as a built-in safety check, but elsewhere states that access rights also permit channeling without ownership. This inconsistency can mislead users into believing the skill enforces a stricter authorization policy than it actually does, increasing the chance they channel on another user's parcel and forfeit rewards.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The file claims the skill protects users from channeling on parcels they do not own, yet earlier documents that access-rights-based channeling on others' parcels is possible. This contradictory assurance is dangerous because users may rely on the claimed protection and unknowingly trigger transactions where another parcel owner receives the rewards while their gotchi still goes on cooldown.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill declares shell-capable behavior and requires external binaries, but does not define any explicit tool scope such as permissions or allowed-tools. In an agent environment, that omission can let the runtime grant broader command execution than reviewers or users expect, increasing the chance of unintended system access, secret exposure, or execution of unsafe commands through supporting scripts.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The document recommends reverse engineering the backend API and monitoring network traffic to obtain signatures, which encourages bypass-style behavior around an anti-bot protection mechanism. In a skill whose stated purpose is to automate channeling and submit transactions, this guidance could lead users to capture authenticated traffic, violate service terms, expose tokens or session data, or build fragile automation against an unofficial interface.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 70% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh source "$SCRIPT_DIR/lib.sh" require_bin cast require_bin curl require_bin jq load_config require_numeric "$GOTCHI_ID" "gotchi-id"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md waitForConfirmation: true }')" RESPONSE="$(curl -sS -X POST "https://api.bankr.bot/agent/submit" \ -H "X-API-Key: $API_KEY" \ -H "Content-Type: application/json" \ -d "$REQUEST_PAYLOAD")"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
sh waitForConfirmation: true }')" RESPONSE="$(curl -sS -X POST "https://api.bankr.bot/agent/submit" \ -H "X-API-Key: $API_KEY" \ -H "Content-Type: application/json" \ -d "$REQUEST_PAYLOAD")"
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The function searches multiple unrelated local sources for a Bankr API key, including user systemd environment and other skill configuration directories, rather than requiring the credential to be provided explicitly for this skill. This broad credential discovery can cause unintended cross-skill secret reuse and silent consumption of sensitive tokens without user awareness, expanding the blast radius if the skill is modified, compromised, or misused.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The code accesses sensitive Bankr credentials from several local locations without any user-facing disclosure, consent flow, or even visible notice that secrets from outside this skill may be read. In an agent skill context, silent secret harvesting is especially risky because users may assume the skill only uses its own config, while the script can transparently pull credentials from broader user state.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The description says the skill performs 'daily harvesting from your REALM parcels,' which implies parcel-centric harvesting behavior. Later in the same document, the actual operation is explicitly a gotchi channeling transaction using channelAlchemica with both parcelId and gotchiId, so the wording overstates or mischaracterizes the action being performed.
- Content
Static analysis
No suspicious patterns detected.