ClawHub
Back to skill

Security audit

Zerion API

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed Zerion wallet-analysis integration, but it under-scopes sensitive third-party financial profiling use cases.

Review before installing if you plan to analyze wallets that are not yours or not clearly authorized. Treat wallet histories and DeFi positions as sensitive financial data, use this only for lawful and approved analysis, keep the Zerion API key protected, and prefer a pinned or otherwise verified installer path.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:19
Finding

Unpinned Package Execution Through npx

Content
View full analysis
Remediation
View remediation
install abishekdharshan/zerion-api ``` 2. Prefer installing the dependency through a lockfile-controlled workflow and invoke the verified local binary afterward. 3. Verify package provenance, registry identity, integrity hashes, and signatures where supported before execution. 4. Avoid running installation commands as `root`, with `sudo`, or from an account holding unrelated sensitive credentials. 5. Execute third-party installers in a restricted environment with minimal filesystem, network, and credential access. 6. Document the tested package version and update it only after security review. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The example workflows directly encourage customer research, competitor analysis, identifying protocol users, portfolio sizing, and cross-chain activity analysis without any caution about consent, legality, or ethical handling of third-party financial data. This makes the skill materially more dangerous because it operationalizes large-scale deanonymization, profiling, and surveillance use cases rather than merely documenting passive blockchain lookup capabilities.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
87% confidence
Finding

The README instructs users to run npx clawhub install abishekdharshan/zerion-api without any version pinning or integrity constraint. This creates a supply-chain risk: if the referenced package, installer behavior, or fetched skill content changes or is compromised, users may install different code than expected, which is especially sensitive here because the skill configures an MCP server and handles API credentials for blockchain-related access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill explicitly enables querying wallet portfolios, transaction histories, DeFi positions, NFTs, and protocol usage tied to specific wallet addresses, but it provides no warning that this can profile identifiable financial behavior and expose sensitive activity of third parties. In a security-sensitive agent context, normalizing this analysis without consent or authorization guidance increases the risk of privacy-invasive surveillance and misuse of public blockchain data at scale.

Content

No source excerpt is available for this finding.