ClawHub
Back to skill

Security audit

Gotchi Equip

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims: it manages Aavegotchi wearables through disclosed Bankr submissions, but users should treat the transactions and API key use as sensitive.

Install only if you intend to let the skill query Goldsky and submit Aavegotchi wearable transactions to Bankr using your Bankr API key. Verify the gotchi ID and slot changes before running commands, especially unequip-all, and consider using a scoped or rotatable Bankr key and updating dependencies during maintenance.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The implemented code is limited to transaction construction for two write actions: equipping wearables and unequipping all wearables by calling equipWearables on the specified Base contract address. There is no logic for inspecting wearables, querying blockchain state, reading current equipment, or returning wearable details. The Base network and Bankr-style submission object are consistent with the description, but the declared 'inspect' capability is not represented in this code chunk, so the description overstates functionality.

Known Vulnerable Dependency: ws==8.18.3 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High
Category
Supply Chain
Confidence
98% confidence
Finding
The lockfile pins transitive dependency ws to 8.18.3, which the finding reports as affected by two disclosed vulnerabilities: uninitialized memory disclosure and memory-exhaustion denial of service. Even though this skill appears focused on blockchain wearable actions, viem can use WebSocket transports, so including a vulnerable ws version can expose the runtime to remote attacks if WebSocket functionality is enabled or reachable.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The markdown advertises an 'Unequip all' command, which changes NFT equipment state in a single transaction, but provides no warning about its broad effect or the need to verify the target gotchi before running it. For markdown files, behaviors that can affect user data or system integrity should include user-facing warnings when the description otherwise presents them as routine commands.

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill declares shell-capable behavior and external dependencies but does not define any explicit tool scope such as allowed-tools or permissions. In an agent environment, missing execution boundaries can let the runtime grant broader shell access than necessary, increasing the chance of command abuse, unintended file access, or unsafe composition with other skills.

External Transmission

Medium
Category
Data Exfiltration
Content
#!/usr/bin/env bash

SUBGRAPH_URL="https://api.goldsky.com/api/public/project_cmh3flagm0001r4p25foufjtt/subgraphs/aavegotchi-core-base/prod/gn"

die() {
  echo "ERROR: $*" >&2
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
The helper silently harvests BANKR_API_KEY not only from the current environment but also from the systemd user environment and two Bankr config files under the user's home directory. For a wearable-management helper, this expands credential access beyond the minimally necessary source and creates cross-skill credential reuse without clear user consent, increasing the blast radius if the skill is modified or abused elsewhere.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The script accesses a sensitive Bankr API credential from environment and local disk locations with no prompt, notice, or confirmation to the user. While it does not exfiltrate the key in this file, undisclosed secret discovery is risky in agent skills because users may not realize the skill is authorized to consume credentials from other components.

External Transmission

Medium
Category
Data Exfiltration
Content
local gotchi_id="$1"
  local payload response

  require_bin curl
  require_bin jq
  validate_gotchi_id "$gotchi_id"
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
echo "Submitting transaction via Bankr..."
API_KEY="$(resolve_bankr_api_key)"

RESPONSE="$(curl -sS -X POST "https://api.bankr.bot/agent/submit" \
  -H "X-API-Key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d @"$TEMP_TX")"
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
echo "Submitting transaction via Bankr..."
API_KEY="$(resolve_bankr_api_key)"

RESPONSE="$(curl -sS -X POST "https://api.bankr.bot/agent/submit" \
  -H "X-API-Key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d @"$TEMP_TX")"
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
require_bin node
require_bin jq
require_bin curl

GOTCHI_ID="$1"
validate_gotchi_id "$GOTCHI_ID"
Confidence
70% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script performs a state-changing blockchain submission immediately after preparing the transaction, without any interactive confirmation, dry-run gate, or explicit opt-in flag. In the context of a wallet/asset-management skill, this increases the risk of accidental execution by a user or calling agent and can lead to unintended wearable changes and transaction costs.

External Transmission

Medium
Category
Data Exfiltration
Content
echo "Submitting transaction via Bankr..."
API_KEY="$(resolve_bankr_api_key)"

RESPONSE="$(curl -sS -X POST "https://api.bankr.bot/agent/submit" \
  -H "X-API-Key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d @"$TEMP_TX")"
Confidence
88% confidence
Finding
This line transmits the prepared transaction and API key to an external service (Bankr). While external submission is core to the skill's purpose, it still creates a real trust boundary: transaction details and credentials leave the local environment, and a compromised or misconfigured endpoint could misuse the API key or submit unintended actions.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"author": "aaigotchi",
  "license": "MIT",
  "dependencies": {
    "viem": "^2.21.54"
  }
}
Confidence
95% confidence
Finding
The dependency uses a caret range (^2.21.54), which allows newer compatible versions to be installed automatically. This can introduce supply-chain risk because future releases of the package may contain vulnerable or malicious code, and a blockchain transaction skill is security-sensitive since dependency behavior can affect transaction construction and signing flows.

Intent-Code Divergence

Low
Confidence
76% confidence
Finding
The script comment explicitly states it will preserve the existing loadout by fetching the current 16-slot wearables before building the transaction. However, the top-level usage/documentation only describes equipping specified wearables and does not mention this read-before-write behavior, creating a mild intent/documentation mismatch about how the operation is carried out.

Static analysis

No suspicious patterns detected.