ClawHub
Back to skill

Security audit

Zerion API

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Zerion wallet-data helper, with expected remote API use and no hidden local execution or persistence found.

Before installing, prefer a pinned or verified ClawHub installer when available, do not run installation from an elevated shell, and avoid sending customer, internal, or investigatory wallet data to the remote Zerion MCP server unless you have authorization and are comfortable with the provider handling that query data.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:7
Finding

Unpinned Third-Party Package Execution During Installation

Content
View full analysis

Vulnerability Details

File Location: README.md, line 7
Vulnerability Type: Supply-chain risk caused by unpinned package execution
Risk Level: Medium

Vulnerable Code:

bash
npx clawhub install abishekdharshan/zerion-api

Technical Analysis

The documented installation command invokes clawhub through npx without pinning the package to a reviewed version or integrity digest. If the package is not already available locally, npx may retrieve it from the configured npm registry and execute it with the installing user's privileges.

Because package resolution can change after this project has been audited, the effective installer code is not fully represented by the two reviewed files. A compromised publisher account, registry compromise, or malicious future package release could cause the same documented command to execute attacker-controlled code.

Attack Path

  1. An attacker compromises the npm package, its publisher account, or the package-distribution path used to resolve clawhub.
  2. The attacker publishes a malicious release that is selected by the unpinned package reference.
  3. A user follows the installation instructions and runs the documented npx command.
  4. npx downloads and executes the malicious package code.
  5. The payload runs with the user's current OS privileges and can access resources available to that account.

Impact Assessment

Successful exploitation could allow arbitrary code execution with the installing user's privileges. Depending on the local environment and user permissions, this could expose readable files, development credentials, API keys, and environment variables; modify user-owned files or configuration; or install additional malicious components. The command itself does not request elevated privileges, so its direct scope is normally limited to the invoking user's access unless it is run from an elevated shell.

Remediation
View remediation

Remediation Suggestions

  • Pin the installer CLI to a specifically reviewed version rather than relying on the registry's current resolution.
  • Use a lockfile or another integrity-verification mechanism where supported.
  • Document the expected package publisher, registry, version, and cryptographic integrity value.
  • Prefer a previously installed and independently verified CLI instead of downloading executable package code at installation time.
  • Review each proposed dependency update before changing the pinned version.
  • Advise users not to run the installation command with administrator or root privileges.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The README instructs users to install the skill via npx clawhub install ... without pinning a specific version or immutable artifact. This can expose users to supply-chain risk if the package, installer behavior, or upstream dependency resolution changes unexpectedly, causing a different or malicious version to be fetched at install time.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This skill encourages users to submit wallet addresses and related portfolio, transaction, and NFT queries to a remote HTTP MCP server but does not warn that those addresses and query contents will be transmitted to a third-party service. Wallet addresses are pseudonymous rather than truly anonymous, and combining them with transaction history, holdings, or investigative use cases can expose sensitive financial profiling or customer intelligence to the remote provider.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.