T09 · Insecure Skill Coding Practices
Error
- Location
use-cases.md:46- Finding
Unrestricted Caller-Controlled URL Fetch Enables SSRF
- Content
View full analysis
- Remediation
View remediation
Security audit
Genlayer Claw Skill
Security checks for vulnerabilities and agentic risk
Overview
This is a read-only GenLayer knowledge skill with no hidden execution or persistence, though some illustrative smart-contract examples need safety review before reuse.
This skill is reasonable to install for learning or explaining GenLayer. Do not treat its contract snippets as production-ready: before building from them, add strict authorization, allowlisted data sources, prompt-injection defenses, privacy review, bounded transfers, appeal or human-review paths, and failure handling.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
use-cases.md:46- Finding
Untrusted Web Content Can Manipulate an LLM-Governed Escrow Transfer
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
use-cases.md:114- Finding
Caller-Controlled Dispute Evidence Can Bias Fund Distribution
- Content
View full analysis
0.85" ) winner = self.parse_winner(result) self.distribute_funds(winner) ``` ### Technical Analysis The `claim`, `evidence_a`, and `evidence_b` fields are untrusted inputs placed directly into the same prompt that contains the adjudication instructions. A party can embed directives in its evidence that attempt to override the task, force a particular winner, manipulate the response format, or exploit ambiguities in `parse_winner`. The requested response includes both a winner and free-form explanation, while consensus is based on semantic similarity rather than a strict, machine-verifiable verdict schema. This increases the likelihood of ambiguous parsing and inconsistent decisions. The result is passed to `distribute_funds` without showing independent validation, authorization checks, value limits, or an appeal requirement. Multiple validators do not guarantee safety when they all receive the same adversarial input. This is an illustrative Markdown example rather than active local code. Its risk arises when developers adopt the pattern in deployed contracts. ### Attack Path 1. A developer deploys a dispute-resolution contract based on the example. 2. One party submits evidence containing adversarial model instructions. 3. The contract incorporates those instructions verbatim into the adjudication prompt. 4. The par ...[truncated 1052 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (12)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 85% confidence
- Finding
The guide includes direct fund transfer functionality without cautioning that transfers are irreversible, authorization-sensitive, and potentially exploitable if exposed through poorly designed public methods. In this context, example code can be copied into production contracts, so missing warnings around access control and failure handling materially increases the chance of unsafe implementations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation shows sending arbitrary user text to an LLM without disclosing that submitted content may be transmitted to a model provider or external processing layer. This is risky because developers may unknowingly route sensitive user data, contract inputs, or regulated information to third-party AI services and may also overlook prompt-injection and output reliability concerns.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The guide demonstrates fetching external web data inside a contract but does not warn that request contents and derived data may leave the execution environment, be logged by third parties, or introduce privacy and integrity risks. In a smart-contract developer guide, omission of these cautions can lead users to pass sensitive inputs or rely on untrusted off-chain data without validation.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 88% confidence
- Finding
The example performs an outbound request to an external HTTPS endpoint from contract logic, which constitutes external data transmission and reliance on off-chain infrastructure. In a developer guide for intelligent contracts, this is more dangerous than ordinary documentation because readers may normalize sending user-controlled or sensitive data externally and trusting unauthenticated responses in consensus-sensitive logic.
- Content
@gl.public.write def get_price(self, symbol: str) -> u256: # Fetch from web API data = gl.web.fetch(f"https://api.example.com/price/{symbol}") price = parse_price(data) return price
python
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 75% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md ### The Micro-Dispute Problem Imagine signing a contract with another human to create an artwork. When receiving it, you notice an extra specification not mentioned during negotiations. A human artist would likely comply without asking for additional payment. But an AI artist? It will immediately request a surcharge. Now imagine the legal system flooded by thousands of micro-disputes about things humans would never argue about. Often, the mental burden of fighting for something small exceeds the potential reward. But what's a mental burden for an AI? Extra five dollars are extra five dollars. As simple as that.
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ## Part V: The Consequences The world is not black or white. Because of the deterministic nature of traditional blockchain VMs, most use cases have remained simplistic. If simple deterministic applications (verifying token transfers) created a market worth trillions, imagine what emerges from consensus designed to be **non-deterministic**. Examples: - Prediction markets on subjective matters
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md ## Part V: The Consequences The world is not black or white. Because of the deterministic nature of traditional blockchain VMs, most use cases have remained simplistic. If simple deterministic applications (verifying token transfers) created a market worth trillions, imagine what emerges from consensus designed to be **non-deterministic**. Examples: - Prediction markets on subjective matters
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This documentation showcases automatic escrow release based on web-fetched proof data and LLM evaluation, but it does not mention failure modes such as prompt manipulation, forged proof sources, ambiguous requirements, or incorrect model judgments. In a blockchain/contract context, readers may treat the example as a safe design pattern and implement irreversible financial logic without human review or cryptographic verification.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The example promotes autonomous treasury rebalancing using external market data and LLM-generated allocation decisions without guardrails or risk disclosures. This can normalize a dangerous pattern where manipulated data, model error, or consensus drift leads to direct financial losses through automatic asset movement.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md @gl.public.write def auto_rebalance(self): # Fetch market data market_data = gl.web.fetch("https://api.example.com/market") # AI determines optimal allocation allocation = gl.llm.complete(
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The dispute-resolution example automatically distributes funds based on an LLM's assessment of free-form evidence, but omits warnings about bias, adversarial evidence, inconsistent reasoning, and appeal/fairness concerns. In this context, the omission is risky because the example couples subjective AI judgment directly to financial settlement.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The KYC/compliance section encourages AI-based document verification and risk scoring across jurisdictions without addressing privacy, consent, retention, cross-border transfer, or regulatory error risks. That omission can lead adopters to process sensitive identity data insecurely or unlawfully.
- Content
Static analysis
No suspicious patterns detected.