ClawHub
Back to skill

Security audit

Asrai Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real crypto-analysis integration, but it asks users to expose wallet and exchange secrets in ways that create serious financial risk.

Review before installing. Use only a dedicated low-balance wallet, do not put a primary wallet key into URLs or shared env files, avoid remote MCP URL examples that include the private key, use read-only exchange API keys with withdrawals and trading disabled, and prefer a pinned, reviewed asrai-mcp version before exposing secrets to it.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
README.md:52
Finding

Wallet Private Key Exposed Through Remote MCP Connection URLs

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 52–55
Vulnerability Type: Wallet private key disclosure through URL query parameters
Risk Level: High

Vulnerable Snippet

text
### 3. n8n / remote connections

HTTP Streamable: https://mcp.asrai.me/mcp?key=0x<your_private_key>
SSE (legacy):    https://mcp.asrai.me/sse?key=0x<your_private_key>

Technical Analysis

The documented remote-connection workflow places the user's wallet private key directly in an HTTPS query parameter. The private key is a signing secret capable of authorizing blockchain transactions; it is not an appropriate remote-service authentication credential.

Using HTTPS protects the request while in transit, but does not prevent the full URL from being recorded by the destination service or by reverse proxies, observability systems, request traces, browser history, client diagnostics, and other URL-processing infrastructure. The local wallet secret therefore crosses into the third-party mcp.asrai.me trust domain and may be retained in multiple logging layers.

The normal x402 payment workflow only requires a locally generated signature. Disclosure of the underlying private key gives the recipient substantially broader authority than is necessary to process a payment.

Attack Path

  1. A user follows the documented n8n or remote MCP setup.
  2. The user substitutes their real wallet private key for <your_private_key>.
  3. The MCP client sends the complete URL to mcp.asrai.me.
  4. The destination server or an intermediary logging or monitoring component records the URL query string.
  5. A party with access to the service or retained logs extracts the private key.
  6. The exposed key is used to sign unauthorized transactions from the affected wallet.

Impact Assessment

Successful exploitation grants control equivalent to possession of the wallet private key. An attacker could authorize blockchain transactions, transfer wallet assets, ...[truncated 327 chars]

Remediation
View remediation

Remediation Suggestions

  • Never transmit a wallet private key to the MCP server.
  • Implement x402 payment signing locally and transmit only the resulting narrowly scoped signature or payment authorization.
  • If remote MCP authentication is required, issue a revocable, least-privilege service token that is unrelated to the wallet private key.
  • Transmit authentication tokens in an authorization header rather than in a URL.
  • Apply short expiration periods, audience restrictions, request limits, and rotation support to service tokens.
  • Redact query strings and authorization material from server, proxy, tracing, and diagnostic logs.
  • Remove the unsafe connection examples and warn existing users to rotate any private keys previously used in these URLs.

T09 · Insecure Skill Coding Practices

Error
Location
references/endpoints.md:76
Finding

Exchange API Secrets Transmitted in GET Request Paths

Content
View full analysis

Vulnerability Details

File Location: references/endpoints.md, lines 76–79
Vulnerability Type: Exchange credential disclosure through URL paths
Risk Level: High

Vulnerable Snippet

text
### Exchange Positions
- `GET /api/exchange/<exchange>/<api_key>/<secret_key>` — live positions for exchange (`mexc`, `binance`, `lighter`)
  - Keys read from `~/.env` automatically: `MEXC_API_KEY`, `MEXC_SECRET_KEY`, `BINANCE_API_KEY`, `BINANCE_SECRET_KEY`, `LIGHTER_L1_ADDRESS`, `LIGHTER_API_PRIVATE_KEY`
  - Returns: account info, open positions, unrealized PnL, leverage, margin, liquidation price

Technical Analysis

The documented exchange-positions endpoint embeds both the API key and secret key in a GET request path. These credentials are automatically read from the user's local ~/.env file and then cross the trust boundary into the Asrai API.

HTTPS does not protect credentials from the destination server or its internal request-processing infrastructure. URL paths are commonly retained in web-server access logs, reverse-proxy logs, application telemetry, tracing systems, security monitoring products, and error reports. Embedding long-lived exchange secrets in the path therefore creates multiple opportunities for credential retention and unauthorized disclosure.

The inclusion of LIGHTER_API_PRIVATE_KEY is particularly sensitive because the documented value is explicitly a private signing key. Exchange secrets should not be used as URL components, and private signing operations should remain local wherever supported.

Attack Path

  1. A user configures exchange credentials in ~/.env as instructed.
  2. The user or agent invokes the positions capability.
  3. The tool reads the configured API key and secret from the local environment.
  4. It constructs a GET request whose path contains both credentials.
  5. The remote service or an intermediary logging or telemetry layer records the request path.
  6. A party with access ...[truncated 756 chars]
Remediation
View remediation

Remediation Suggestions

  • Do not place API keys, secret keys, or private signing keys in URL paths or query strings.
  • Keep request signing local whenever the exchange supports signed API requests; send only the signed exchange request rather than the reusable secret.
  • If server-side credential processing is unavoidable, use a POST request body over TLS and explicitly disable body logging and tracing for that endpoint.
  • Prefer revocable, short-lived delegated tokens over long-lived exchange secrets.
  • Require exchange keys to be read-only for position retrieval and instruct users to disable trading and withdrawal permissions.
  • Recommend exchange-side IP restrictions, least-privilege scopes, key rotation, and separate keys for this integration.
  • Redact credentials from application logs, proxy logs, errors, traces, metrics, and support diagnostics.
  • Rotate all credentials previously transmitted through these URL paths.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Findings (49)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README instructs users to place a blockchain private key directly into ~/.env with no strong warning about sensitivity, compartmentalization, or risk of theft. In an agent and shell-integrated environment, that key may be accessible to executed tooling, logs, or other local processes, leading to direct financial loss.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

The documented use of ~/.env for a private key indicates credential access and storage in a location commonly consumed by local tooling. In the context of shell-executed npm packages and agent integrations, this materially increases exposure of a fund-controlling secret to any compromised dependency or over-privileged local process.

Content

Scanner excerpt · README.md (reported line 42)May include surrounding context.

1. Set your private key

bash
echo "ASRAI_PRIVATE_KEY=0x<your_private_key>" >> ~/.env

Your wallet must hold USDC on Base mainnet (~$1–2 is plenty).

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

Requesting exchange API credentials and offering live positions retrieval expands the skill into credential handling and private financial account access beyond passive analysis. If the tool, dependencies, or agent environment are compromised, attackers could exfiltrate sensitive API keys and trading-account data.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The exchange setup section asks users to place API keys and private keys in ~/.env without clear warnings about credential sensitivity, required scopes, or account-risk implications. If exposed through local compromise, logs, package execution, or agent tooling, these credentials could reveal account data and potentially enable unauthorized trading or withdrawals depending on scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill tells users to place a blockchain private key in the environment and states that payment is signed automatically, but it does not prominently warn about wallet-compromise risk, transaction authority, or safe key-management practices. If the tool, its dependencies, or the host are compromised, the private key could be exfiltrated and used for unauthorized on-chain spending.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

The documentation explicitly instructs users to place a raw private key into ~/.env, which normalizes storage of highly sensitive credentials in a broadly accessible plaintext environment file. In the context of a Node/npm-based toolchain and external MCP integrations, that increases the risk of accidental disclosure, process-level exposure, or theft by compromised dependencies.

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

Auto-detects OpenClaw, Cursor, Cline, and other agents. Then set your key:

text
ASRAI_PRIVATE_KEY=0x<your_private_key>  # add to ~/.env

For MCP agents (Cursor, Cline, Claude Desktop) also add to config:

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.

md
Only configure the exchanges you use — tool auto-detects which keys are set.

## Output rules

🎨 Output Style — Human-Friendly Format

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · asrai-x402.skill!/SKILL.md (reported line 52)May include surrounding context.

Auto-detects OpenClaw, Cursor, Cline, and other agents. Then set your key:

text
ASRAI_PRIVATE_KEY=0x<your_private_key>  # add to ~/.env

For MCP agents (Cursor, Cline, Claude Desktop) also add to config:

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · asrai-x402.skill!/SKILL.md (reported line 151)May include surrounding context.

md
Only configure the exchanges you use — tool auto-detects which keys are set.

## Output rules

🎨 Output Style — Human-Friendly Format

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The README directs users to execute an unpinned package with npx, which fetches the latest published version at runtime. If the npm package or publisher account is compromised, users and agents could automatically run attacker-controlled code during installation or tool execution.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
84% confidence
Finding

The npx skills add guidance also relies on runtime package resolution without a pinned version, creating a supply-chain risk similar to other npx usage. While the exact package fetched is less explicit here, it still encourages execution of mutable remote code from the package ecosystem.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The guidance says to ask naturally and let the agent pick the right tool automatically, with broad examples that overlap ordinary crypto discussion. That increases the chance of unintentional tool invocation, causing unexpected paid requests, remote network access, or execution paths the user did not explicitly authorize.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

This example command executes the latest asrai-mcp package on demand, exposing users to upstream compromise or typosquatting risks. Because the command is intended for direct shell execution by agents, exploitation could result in immediate code execution in the user's environment.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

This shell example uses unpinned npx execution of asrai-mcp, allowing silent changes in fetched code over time. In an agent-integrated workflow, that increases the chance that normal user prompts trigger execution of compromised package code.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

This command demonstrates executing a mutable remote package via npx without version pinning. A compromised or malicious package update could run arbitrary code and access local environment variables, including wallet and exchange credentials described elsewhere in the README.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

Unpinned npx usage here creates a supply-chain execution path for arbitrary updated code. Because the skill is designed to run financial-analysis commands, the surrounding environment is likely to contain sensitive keys and account data, increasing the blast radius.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

This example executes asrai-mcp directly from npm without version pinning, enabling arbitrary code execution if the package supply chain is compromised. The risk is amplified because the README encourages broad agent use, so many natural-language requests could reach these commands.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The command relies on fetching the latest package state each time through npx, which is unsafe for a tool handling crypto-related workflows. An attacker controlling the package or dependency chain could execute code and potentially exfiltrate configured secrets.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

This shell invocation repeats the same unpinned runtime package execution pattern, making command behavior mutable and vulnerable to npm supply-chain attacks. Given the documented use of private keys and exchange credentials, successful compromise could have financial impact beyond normal code execution risk.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The README encourages users to run this unpinned npx command directly, which can pull altered code at any future time. In a wallet-backed payment context, this creates a path from documentation to arbitrary code execution in a financially sensitive environment.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

This command inherits the same package supply-chain issue: npx executes the latest package contents without a fixed version. Because the skill can be auto-invoked by agents, users may not realize a common prompt could lead to execution of changed code.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

This final command example also executes a mutable npm package directly, preserving the same arbitrary code execution and secret-exposure risk. Repetition across the README normalizes an unsafe pattern and increases the chance it will be copied into production agent workflows.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README broadens the capability from market analysis into linked exchange-account position retrieval, which materially changes the trust model and data sensitivity. This mismatch can cause users or reviewers to underestimate the permissions and account visibility the skill may require.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger guidance is broad enough to route many general crypto-related prompts to this paid, credentialed external toolchain, even when a direct answer may suffice. That increases the chance of unintended invocation, unnecessary billing, and exposure of user queries to an external service without clear need.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The skill instructs users/agents to install and run asrai-mcp via npx without pinning a specific version or integrity hash. That creates a supply-chain risk: a malicious or compromised package update could be fetched and executed automatically, and in this skill's context the package is also given access to a wallet private key used for automatic payment signing.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.