ClawHub
Back to skill

Security audit

Intel — AI Web Search (x402)

Security checks for vulnerabilities and agentic risk

Overview

This paid search skill is understandable in purpose, but it handles wallet private keys and paid automatic searches in ways that need careful review before use.

Review this carefully before installing. Do not put a primary wallet private key in these configs or URLs; if testing, use a dedicated low-balance wallet, avoid remote key-in-URL setup, pin and verify the npm package, and require explicit approval or spending limits before paid searches.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T08 · Insecure Dependencies

Error
Location
SKILL.md:15
Finding

Unpinned npm Package Is Downloaded and Executed with Wallet-Key Access

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:15, SKILL.md:23, SKILL.md:52; README.md:12, README.md:29, README.md:44, README.md:61, README.md:76
Vulnerability Type: Unpinned third-party dependency and mutable remote execution
Risk Level: Critical

Vulnerable Code

SKILL.md:15

bash
npx -y -p intel-asrai-mcp install-skill

SKILL.md:23

json
{
  "mcpServers": {
    "intel-search": { "command": "npx", "args": ["-y", "intel-asrai-mcp"] }
  }
}

SKILL.md:52

bash
npx -y -p intel-asrai-mcp intel-search "<query>" <mode> <sources>

Equivalent unpinned invocations are also documented in README.md:12, README.md:29, README.md:44, README.md:61, and README.md:76.

Technical Analysis

The skill directs agents to use npx -y with the package name intel-asrai-mcp but does not specify an exact package version or verify a cryptographic integrity digest. Consequently, each installation or runtime search can retrieve and execute the package version currently published by the registry.

The -y option automatically accepts installation prompts, eliminating an opportunity for the user to review the package being downloaded. The package is also explicitly configured to receive INTEL_PRIVATE_KEY, a cryptocurrency wallet private key. A compromised maintainer account, npm package, registry response, or malicious future package release could therefore execute arbitrary code with both the local user's privileges and access to the wallet credential.

The artifact contains only documentation and does not include the npm package implementation, so the externally retrieved executable payload cannot be verified within this audit.

Attack Path

  1. An attacker compromises the npm package, its maintainer account, or a future release channel.
  2. The attacker publishes a malicious version under the existing intel-asrai-mcp package name.
  3. A ...[truncated 846 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin the dependency to a reviewed exact version, such as intel-asrai-mcp@x.y.z; do not use a floating package name.
  • Install dependencies through a committed lockfile and enforce package integrity hashes.
  • Remove -y so unexpected package installation or version changes require explicit approval.
  • Prefer vendoring and auditing the executable implementation rather than retrieving mutable code whenever a search is performed.
  • Execute the package in a restricted sandbox with minimal filesystem and network access.
  • Do not expose the primary wallet private key directly to the package. Use a dedicated low-value wallet or a narrowly scoped local signing service.
  • Require explicit confirmation and display transaction details before every payment signature.
  • Add dependency provenance verification, registry allowlisting, automated vulnerability scanning, and release-signature validation.

T09 · Insecure Skill Coding Practices

Error
Location
README.md:84
Finding

Cryptocurrency Private Key Is Placed in Remote URL Query Parameters

Content
View full analysis

Vulnerability Details

File Location: README.md:84-85; references/endpoints.md:9-10
Vulnerability Type: Sensitive credential exposure through URL query parameters
Risk Level: Critical

Vulnerable Code

README.md:84-85

text
- HTTP Streamable: `https://intel-mcp.asrai.me/mcp?key=0x<your_private_key>`
- SSE (legacy): `https://intel-mcp.asrai.me/sse?key=0x<your_private_key>`

references/endpoints.md:9-10

text
| HTTP Streamable | `https://intel-mcp.asrai.me/mcp?key=0x<your_private_key>` |
| SSE (legacy) | `https://intel-mcp.asrai.me/sse?key=0x<your_private_key>` |

Technical Analysis

The documentation instructs users to place a cryptocurrency private key directly in a URL query string. Query parameters are routinely retained by client configuration, browser history, shell history, reverse proxies, web-server access logs, observability platforms, debugging output, crash reports, and screenshots.

The remote endpoint also necessarily receives the complete URL, meaning the private key is disclosed to infrastructure outside the user's local trust boundary. Unlike a revocable session token, a wallet private key can directly represent signing authority over the associated account.

TLS protects the URL while it is in transit but does not prevent disclosure at either endpoint or through application and infrastructure logging.

Attack Path

  1. A user follows the documented configuration and inserts the wallet private key into the MCP or SSE URL.
  2. The client connects to the remote endpoint and transmits the URL containing the key.
  3. The complete URL is retained in client state, logs, proxy telemetry, server logs, support diagnostics, or configuration backups.
  4. An attacker, administrator, third-party monitoring provider, or other party with access to one of those records obtains the key.
  5. The exposed key is imported into attacker-controlled wallet sof ...[truncated 532 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove all instructions that place private keys in URLs.
  • Never transmit the wallet private key to a remote MCP server.
  • Perform payment signing locally and send only the resulting narrowly scoped signed payment or protocol message.
  • Use a hardware wallet, operating-system key store, or isolated signing process that does not reveal raw private-key material.
  • If remote authentication is required, use a short-lived, revocable token in an authorization header rather than a query parameter.
  • Use a dedicated low-value wallet with transaction limits instead of a primary wallet.
  • Redact credentials from all application, proxy, server, and observability logs.
  • Rotate any key that has already been configured in one of the documented URLs and transfer remaining assets to a newly generated wallet.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:49
Finding

User-Controlled Search Query Is Interpolated into a Shell Command

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:49-59
Vulnerability Type: OS command injection through unsafe shell interpolation
Risk Level: Critical

Vulnerable Code

markdown
### If no MCP tool — use bash (OpenClaw and other agents)

```bash
npx -y -p intel-asrai-mcp intel-search "<query>" <mode> <sources>

Examples:

bash
npx -y -p intel-asrai-mcp intel-search "bitcoin price today" speed web
npx -y -p intel-asrai-mcp intel-search "latest AI research" quality academic
npx -y -p intel-asrai-mcp intel-search "what people think about X" balanced discussions
text

### Technical Analysis

The search query originates from conversation content and is therefore potentially attacker-controlled. The skill instructs the agent to construct and execute a Bash command by substituting that content into a command template.

Double quotes are not a complete defense against shell injection. Bash still evaluates command substitution forms such as `$(command)` and backticks inside double-quoted strings. A payload may also attempt to break out of quoting if the command is assembled without a robust argument-array API. The unquoted `mode` and `sources` placeholders create additional injection surfaces unless they are strictly constrained to documented enum values.

The instructions do not require shell-safe argument handling, escaping, validation, or use of a process API that bypasses shell parsing.

### Attack Path

1. An attacker supplies a request that appears to require current information and embeds shell syntax in the search query.
2. The agent follows the skill's fallback instructions and substitutes the query into the documented Bash command.
3. Bash parses the resulting command and evaluates command substitution or quote-breaking syntax before invoking `intel-search`.
4. The injected command runs with the same privileges as the agent.
5. The command can read local files or
...[truncated 899 chars]
Remediation
View remediation

Remediation Suggestions

  • Do not build a shell command by interpolating conversation-derived text.
  • Prefer the structured MCP tool interface, where the query, mode, and source are separate typed parameters.
  • For a local fallback, use a process-spawning API with a fixed executable and an argument array, with shell interpretation disabled.
  • If Bash is unavoidable, pass the query through positional parameters rather than inserting it into an evaluated command string.
  • Strictly allowlist mode to speed, balanced, or quality.
  • Strictly allowlist sources to web, academic, or discussions.
  • Reject unexpected control characters and never use eval, bash -c, or equivalent secondary evaluation.
  • Run the search process in a restricted environment that does not contain unrelated credentials, especially the primary wallet key.
  • Add automated tests using quotes, semicolons, command substitutions, backticks, newlines, and option-injection inputs to verify that every query remains one literal argument.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Findings (17)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

Embedding a private key directly in remote connection URLs is highly dangerous because URLs are routinely exposed in logs, process listings, monitoring tools, copy/paste history, and intermediary infrastructure. For a micropayment web-search skill, this is far more dangerous than the stated functionality justifies, because compromise of the URL means compromise of the user's wallet credentials.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The README instructs users to send their private key in a URL query string to a remote service. Query parameters are commonly logged by clients, proxies, servers, browser history, observability systems, and reverse proxies, so this design can directly expose the wallet's signing secret and enable theft of funds or broader wallet compromise.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
89% confidence
Finding

The skill directs users to store a private key in ~/.env, a broad environment location that may be accessible to other tools, shells, logs, or processes in the same user context. In a skill that also recommends executing external packages and shell commands, this materially increases the chance of credential theft and unauthorized signing.

Content

Scanner excerpt · SKILL.md (reported line 19)May include surrounding context.

Auto-detects OpenClaw, Cursor, Cline, and other agents. Then set your key:

text
INTEL_PRIVATE_KEY=0x<your_private_key>  # add to ~/.env

For MCP agents (Cursor, Cline, Claude Desktop) also add to config:

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

md
- **mode** — `speed` (fast, news), `balanced` (default), `quality` (deep research)
- **sources** — `web` (default), `academic` (papers), `discussions` (Reddit/forums)

## Output rules

- Lead with the synthesized answer — no preamble
- List sources as numbered links after the answer

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The documentation explicitly instructs users to include a wallet private key in the MCP server URL query string. Query parameters are routinely exposed through browser history, logs, reverse proxies, analytics, crash reports, and referrer leakage, so this creates a direct path to irreversible wallet compromise and unauthorized signing/payment activity. In this skill’s context, the secret is far more sensitive than a normal API token because it controls on-chain funds.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The README instructs users to execute an unpinned npm package directly via npx, which fetches and runs the latest published code at install time. This creates a supply-chain risk: if the package is compromised, typo-squatted, or a malicious update is published, users may execute arbitrary code without review.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

This command relies on npx to fetch and run tooling without version pinning, which introduces a supply-chain exposure similar to other dynamic npm execution patterns. While npx skills is more generic and may refer to an existing trusted tool in the user's environment, the README still normalizes executing mutable remote package code during installation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README tells users to store a blockchain private key in plaintext environment/config locations without emphasizing the sensitivity of that secret or the operational risks. Although local environment variables are common, a private key is a high-value credential; storing it this way increases exposure to local compromise, accidental backup/sync leakage, shell history mistakes, and misconfigured permissions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The MCP configuration tells clients to launch an unpinned npm package via npx, so each setup may execute whatever version is current in the registry rather than a reviewed release. In the context of an agent-integrated MCP server that receives prompts and wallet material, this makes a package compromise especially dangerous.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The skill tells users to execute an unpinned npm package via npx, which fetches and runs whatever version is current at invocation time. If the package is compromised, hijacked, or updated maliciously, arbitrary code could execute in the agent environment and access wallet credentials configured for the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill instructs users to place a blockchain wallet private key in an environment file and states payments are signed automatically, but it does not present a strong upfront warning about fund risk, key handling, or use of a dedicated low-value wallet. In an agent ecosystem, this can lead users to expose high-value credentials to tools that may execute shell commands or third-party packages.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs agents to invoke a paid search tool or shell command whenever certain query types appear, but the warning about per-search spend is not placed prominently with the execution instructions. That makes accidental or repeated fund expenditure more likely, especially for autonomous or semi-autonomous agents following the skill literally.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This command path also invokes an unpinned package through npx, creating a supply-chain execution risk every time the search command is run. In this skill's context, that risk is amplified because the environment may contain INTEL_PRIVATE_KEY, allowing malicious package code to exfiltrate signing material or trigger unauthorized transactions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The example command normalizes repeated execution of an unpinned remote package, which can change over time without user review. Because the skill is tied to automatic payment signing, compromise of the package could lead to code execution plus financial loss.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This example repeats the unsafe npx pattern, training users and agents to trust live package resolution for a wallet-enabled tool. An attacker controlling the package or one of its dependencies could execute arbitrary code and misuse or steal funds.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This is another instance of unpinned package execution, carrying the same supply-chain risk as the other npx examples. The surrounding wallet-payment workflow makes the consequence more severe than a normal search utility because secrets and spend capability are present.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The endpoint examples normalize sending a private key via URL parameters and provide no warning about the severe leakage risk. Even if intended for convenience, documenting this pattern encourages unsafe operational behavior and makes accidental disclosure likely through standard infrastructure logging and client tooling. Because this is a web search skill, requiring or suggesting raw private-key handling is unjustified and substantially increases danger relative to the feature provided.

Content

No source excerpt is available for this finding.