ClawHub
Back to skill

Security audit

Gotchi Pocket

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly purpose-aligned for Aavegotchi wallet operations, but it handles financial transactions and Bankr credentials with under-scoped endpoint and credential-discovery behavior users should review before installing.

Install only if you trust the publisher and your runtime environment. Keep BANKR_API_URL unset unless intentionally testing, protect and rotate BANKR_API_KEY, review every deposit or withdrawal before execution, and avoid using this skill where untrusted agents or wrappers can control environment variables.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/lib.sh:7
Finding

Bankr API key can be transmitted to an attacker-controlled endpoint

Content
View full analysis
/dev/null 2>&1; then key="$(systemctl --user show-environment 2>/dev/null | sed -n "s/^BANKR_API_KEY=//p" | head -n1 || true)" fi if [ -z "$key" ] && [ -f "$HOME/.openclaw/skills/bankr/config.json" ]; then key="$(jq -r '.apiKey // empty' "$HOME/.openclaw/skills/bankr/config.json" 2>/dev/null || true)" fi if [ -z "$key" ] && [ -f "$HOME/.openclaw/workspace/skills/bankr/config.json" ]; then key="$(jq -r '.apiKey // empty' "$HOME/.openclaw/workspace/skills/bankr/config.json" 2>/dev/null || true)" fi [ -n "$key" ] || err "BANKR_API_KEY not found in env, systemd, or Bankr config" echo "$key" } ``` Transaction submission sends the recovered credential to the configurable endpoint: ```bash submit_bankr_tx() { local to_address="$1" local calldata="$2" local description="$3" local api_key local payload api_key="$(resolve_bankr_api_key)" payload="$(jq -n \ --arg to "$to_address" \ --arg data "$calldata" \ --arg description "$description" \ '{transaction:{to:$to,chainId:8453,value:"0",data:$data},description:$description,waitForConfirmat ...[truncated 4258 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md
- `./scripts/pocket-deposit.sh <gotchi-id> <token-alias-or-address> <amount> [--raw]`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

md
- `./scripts/pocket-deposit.sh <gotchi-id> <token-alias-or-address> <amount> [--raw]`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md
- `./scripts/pocket-withdraw.sh <gotchi-id> <token-alias-or-address> <to-address> <amount> [--raw]`

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

md
- `./scripts/pocket-withdraw.sh <gotchi-id> <token-alias-or-address> <to-address> <amount> [--raw]`

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding

The skill invokes shell-based scripts and performs blockchain-affecting operations, but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization ambiguity where an agent or runtime may grant broader shell access than intended, increasing the risk of unintended command execution or transaction-capable actions beyond the documented behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest describes wallet operations on gotchi pockets, but this helper actively searches for credentials in systemd user environment and Bankr config files under the user's home directory. Accessing local credential sources is not explicitly justified by the stated skill purpose and expands the skill's capability into credential discovery.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This helper submits signed transaction instructions and the API key to an external Bankr endpoint without any built-in confirmation, disclosure, or allowlist enforcement in this file. In a wallet-management skill, external transaction submission is expected, but absent guardrails it can enable unintended on-chain actions if called with attacker-controlled parameters elsewhere in the skill.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The code posts transaction details and an API credential to a remote endpoint, which is an external transmission of sensitive operational data. Given the skill's purpose, some transmission is necessary, but this remains dangerous because compromise or misuse of the remote service could trigger unauthorized asset movement from pocket wallets.

Content

Scanner excerpt · scripts/lib.sh (reported line 238)May include surrounding context.

sh
--arg description "$description" \
    '{transaction:{to:$to,chainId:8453,value:"0",data:$data},description:$description,waitForConfirmation:true}')"

  curl -s -X POST "$BANKR_API_URL/agent/submit" \
    -H "X-API-Key: $api_key" \
    -H "Content-Type: application/json" \
    -d "$payload"

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill sends a plain-English prompt to Bankr to discover the user's wallet address, introducing an unnecessary remote LLM-mediated step for data that should be obtained through a deterministic API or local configuration. This expands the trust boundary, leaks interaction metadata to a third party, and makes ownership checks depend on parsing unstructured remote output.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/pocket-command.py (reported line 139)May include surrounding context.

python
if dry_run:
        return 0

    proc = subprocess.run(cmd, text=True, capture_output=True)

    if proc.stdout:
        print(proc.stdout, end="")

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

This helper posts a natural-language prompt to the Bankr API and then polls job status using the API key, which is a network operation involving external transmission. The file provides no user-visible warning, prompt, or explanatory comment for this external request behavior.

Content

No source excerpt is available for this finding.