ClawHub
Back to skill

Security audit

Gotchi Equip

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims: it manages Aavegotchi wearables through disclosed Bankr submissions, but users should treat the transactions and API key use as sensitive.

Install only if you intend to let the skill query Goldsky and submit Aavegotchi wearable transactions to Bankr using your Bankr API key. Verify the gotchi ID and slot changes before running commands, especially unequip-all, and consider using a scoped or rotatable Bankr key and updating dependencies during maintenance.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The implemented code is limited to transaction construction for two write actions: equipping wearables and unequipping all wearables by calling equipWearables on the specified Base contract address. There is no logic for inspecting wearables, querying blockchain state, reading current equipment, or returning wearable details. The Base network and Bankr-style submission object are consistent with the description, but the declared 'inspect' capability is not represented in this code chunk, so the description overstates functionality.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.18.3 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High
Category
Supply Chain
Confidence
98% confidence
Finding

The lockfile pins transitive dependency ws to 8.18.3, which the finding reports as affected by two disclosed vulnerabilities: uninitialized memory disclosure and memory-exhaustion denial of service. Even though this skill appears focused on blockchain wearable actions, viem can use WebSocket transports, so including a vulnerable ws version can expose the runtime to remote attacks if WebSocket functionality is enabled or reachable.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The markdown advertises an 'Unequip all' command, which changes NFT equipment state in a single transaction, but provides no warning about its broad effect or the need to verify the target gotchi before running it. For markdown files, behaviors that can affect user data or system integrity should include user-facing warnings when the description otherwise presents them as routine commands.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill declares shell-capable behavior and external dependencies but does not define any explicit tool scope such as allowed-tools or permissions. In an agent environment, missing execution boundaries can let the runtime grant broader shell access than necessary, increasing the chance of command abuse, unintended file access, or unsafe composition with other skills.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/common.sh (reported line 3)May include surrounding context.

sh
#!/usr/bin/env bash

SUBGRAPH_URL="https://api.goldsky.com/api/public/project_cmh3flagm0001r4p25foufjtt/subgraphs/aavegotchi-core-base/prod/gn"

die() {
  echo "ERROR: $*" >&2

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The helper silently harvests BANKR_API_KEY not only from the current environment but also from the systemd user environment and two Bankr config files under the user's home directory. For a wearable-management helper, this expands credential access beyond the minimally necessary source and creates cross-skill credential reuse without clear user consent, increasing the blast radius if the skill is modified or abused elsewhere.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The script accesses a sensitive Bankr API credential from environment and local disk locations with no prompt, notice, or confirmation to the user. While it does not exfiltrate the key in this file, undisclosed secret discovery is risky in agent skills because users may not realize the skill is authorized to consume credentials from other components.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/common.sh (reported line 43)May include surrounding context.

sh
local gotchi_id="$1"
  local payload response

  require_bin curl
  require_bin jq
  validate_gotchi_id "$gotchi_id"

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/equip.sh (reported line 104)May include surrounding context.

sh
echo "Submitting transaction via Bankr..."
API_KEY="$(resolve_bankr_api_key)"

RESPONSE="$(curl -sS -X POST "https://api.bankr.bot/agent/submit" \
  -H "X-API-Key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d @"$TEMP_TX")"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/equip.sh (reported line 104)May include surrounding context.

sh
echo "Submitting transaction via Bankr..."
API_KEY="$(resolve_bankr_api_key)"

RESPONSE="$(curl -sS -X POST "https://api.bankr.bot/agent/submit" \
  -H "X-API-Key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d @"$TEMP_TX")"

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/unequip-all.sh (reported line 34)May include surrounding context.

sh
require_bin node
require_bin jq
require_bin curl

GOTCHI_ID="$1"
validate_gotchi_id "$GOTCHI_ID"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script performs a state-changing blockchain submission immediately after preparing the transaction, without any interactive confirmation, dry-run gate, or explicit opt-in flag. In the context of a wallet/asset-management skill, this increases the risk of accidental execution by a user or calling agent and can lead to unintended wearable changes and transaction costs.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This line transmits the prepared transaction and API key to an external service (Bankr). While external submission is core to the skill's purpose, it still creates a real trust boundary: transaction details and credentials leave the local environment, and a compromised or misconfigured endpoint could misuse the API key or submit unintended actions.

Content

Scanner excerpt · scripts/unequip-all.sh (reported line 80)May include surrounding context.

sh
echo "Submitting transaction via Bankr..."
API_KEY="$(resolve_bankr_api_key)"

RESPONSE="$(curl -sS -X POST "https://api.bankr.bot/agent/submit" \
  -H "X-API-Key: $API_KEY" \
  -H "Content-Type: application/json" \
  -d @"$TEMP_TX")"

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency uses a caret range (^2.21.54), which allows newer compatible versions to be installed automatically. This can introduce supply-chain risk because future releases of the package may contain vulnerable or malicious code, and a blockchain transaction skill is security-sensitive since dependency behavior can affect transaction construction and signing flows.

Content

Scanner excerpt · package.json (reported line 19)May include surrounding context.

json
"author": "aaigotchi",
  "license": "MIT",
  "dependencies": {
    "viem": "^2.21.54"
  }
}

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The script comment explicitly states it will preserve the existing loadout by fetching the current 16-slot wearables before building the transaction. However, the top-level usage/documentation only describes equipping specified wearables and does not mention this read-before-write behavior, creating a mild intent/documentation mismatch about how the operation is carried out.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.