ClawHub
Back to skill

Security audit

HL Privateer

Security checks for vulnerabilities and agentic risk

Overview

This is a finance skill for paid trading data, but it also documents wallet-backed payments and trading-control APIs without enough user-safety boundaries.

Review before installing or enabling automation. Use only for user-requested trading-data lookups, keep any x402 wallet isolated and low-balance, require confirmation for every paid call, validate payment recipient/asset/network/amount/resource before signing, and do not expose operator credentials or live trading command channels to an autonomous agent.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
x402.md:65
Finding

Unvalidated Server-Directed Cryptocurrency Payment Authorization

Content
View full analysis
"); const wallet = createWalletClient({ account, chain: base, transport: http() }); const client = new x402Client(wallet); const response = await client.fetch( "https://api.hlprivateer.xyz/v1/agent/positions" ); const data = await response.json(); ``` ### Technical Analysis The documented x402 flow requires the client to sign a cryptocurrency authorization derived from a server-provided challenge. Fields such as `network`, `asset`, `resource`, `payTo`, `maxAmountRequired`, and expiration constraints determine what asset can be transferred, to whom, for what amount, and for how long the authorization remains usable. The guide does not require the client to verify these values against a local policy before signing. In part ...[truncated 2451 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (26)

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill metadata describes read-only access to a discretionary trading desk, but the documented agent API includes state-changing endpoints such as handshake, command execution, and tier unlock. This mismatch can mislead downstream agents or users into granting trust to a capability set that includes action execution and access escalation, increasing the chance of unintended trading or privilege misuse.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The operator API exposes administrative functions including login, command execution, risk configuration changes, and replay/export operations that are not reflected in the skill's stated purpose. In an agent-skill context, hidden or under-disclosed admin surfaces are dangerous because they can enable halting, resuming, flattening, or reconfiguring a live trading system if authentication is obtained or mishandled.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill explicitly instructs agents to mirror trades and poll copy-trading endpoints, but provides no warning that executing these signals could place trades on the user's own account and expose them to financial loss. In an agent setting, omission of such warnings increases the risk of autonomous or semi-autonomous trading behavior without informed user consent or appropriate risk controls.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest markets broad autonomous trading, signal-following, and integration behavior without clearly constraining when the skill should be invoked or what it is permitted to do. In an agent ecosystem, vague invocation language can cause over-selection or inappropriate use in financial contexts, increasing the chance that an agent routes users into paid trading-related flows without adequate suitability checks or explicit user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill exposes paid trading-signal and copy-trading endpoints, including x402 monetized access, but the manifest description does not warn users about financial risk, paid access, or the danger of relying on autonomous discretionary trading outputs. In this context, missing warnings are especially dangerous because users may treat the skill as safe investment guidance or incur charges and trading losses without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The operator command documentation lists destructive actions such as /halt, /resume, and /flatten without any cautionary disclosure or workflow guardrails. In a live trading context, omission of warnings materially increases the risk that an LLM agent, integrator, or human operator invokes high-impact commands without understanding that they can stop trading or liquidate positions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The risk configuration update endpoint is presented without warning despite modifying live safety-critical parameters. In a trading system, undocumented sensitivity around risk controls can lead to accidental weakening of safeguards, increased leverage/exposure, or bypass of protections intended to prevent losses.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
81% confidence
Finding

Replay export is documented without noting that exported incident and operational data may contain sensitive trading, audit, or system information. In an agent-accessible environment, lack of disclosure can cause oversharing of confidential telemetry or audit trails to less-trusted systems or users.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The WebSocket interface includes command execution via cmd.exec and operator channels/events, which goes beyond the advertised read-access use case. Real-time bidirectional command paths are especially risky in agent environments because they can be triggered more easily than explicit REST admin calls and may blur the boundary between observation and control.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly promotes copy-trading and paid trading-signal consumption but does not include a clear warning that following these signals can lead to real financial losses. In this context, users may treat the skill as actionable investment guidance and automate decisions without understanding market, execution, and counterparty risks.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md
## Quick Start

1. GET https://api.hlprivateer.xyz/v1/agent/stream/snapshot
2. Receive 402 + PAYMENT-REQUIRED header (Base64 JSON)
3. Decode to get price, network, payTo, facilitator
4. Sign x402 payment (USDC on Base, eip155:8453)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

md
## Quick Start

1. GET https://api.hlprivateer.xyz/v1/agent/stream/snapshot
2. Receive 402 + PAYMENT-REQUIRED header (Base64 JSON)
3. Decode to get price, network, payTo, facilitator
4. Sign x402 payment (USDC on Base, eip155:8453)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · hl-privateer.md (reported line 48)May include surrounding context.

md
## Quick Start

1. GET https://api.hlprivateer.xyz/v1/agent/stream/snapshot
2. Receive 402 + PAYMENT-REQUIRED header (Base64 JSON)
3. Decode to get price, network, payTo, facilitator
4. Sign x402 payment (USDC on Base, eip155:8453)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · hl-privateer.md (reported line 110)May include surrounding context.

md
## Quick Start

1. GET https://api.hlprivateer.xyz/v1/agent/stream/snapshot
2. Receive 402 + PAYMENT-REQUIRED header (Base64 JSON)
3. Decode to get price, network, payTo, facilitator
4. Sign x402 payment (USDC on Base, eip155:8453)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · llms.txt (reported line 22)May include surrounding context.

text
## Quick Start

1. GET https://api.hlprivateer.xyz/v1/agent/stream/snapshot
2. Receive 402 + PAYMENT-REQUIRED header (Base64 JSON)
3. Decode to get price, network, payTo, facilitator
4. Sign x402 payment (USDC on Base, eip155:8453)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · x402.md (reported line 49)May include surrounding context.

md
## Quick Start

1. GET https://api.hlprivateer.xyz/v1/agent/stream/snapshot
2. Receive 402 + PAYMENT-REQUIRED header (Base64 JSON)
3. Decode to get price, network, payTo, facilitator
4. Sign x402 payment (USDC on Base, eip155:8453)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · x402.md (reported line 76)May include surrounding context.

md
## Quick Start

1. GET https://api.hlprivateer.xyz/v1/agent/stream/snapshot
2. Receive 402 + PAYMENT-REQUIRED header (Base64 JSON)
3. Decode to get price, network, payTo, facilitator
4. Sign x402 payment (USDC on Base, eip155:8453)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · x402.md (reported line 157)May include surrounding context.

md
## Quick Start

1. GET https://api.hlprivateer.xyz/v1/agent/stream/snapshot
2. Receive 402 + PAYMENT-REQUIRED header (Base64 JSON)
3. Decode to get price, network, payTo, facilitator
4. Sign x402 payment (USDC on Base, eip155:8453)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · x402.md (reported line 192)May include surrounding context.

md
## Quick Start

1. GET https://api.hlprivateer.xyz/v1/agent/stream/snapshot
2. Receive 402 + PAYMENT-REQUIRED header (Base64 JSON)
3. Decode to get price, network, payTo, facilitator
4. Sign x402 payment (USDC on Base, eip155:8453)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · x402.md (reported line 205)May include surrounding context.

md
## Quick Start

1. GET https://api.hlprivateer.xyz/v1/agent/stream/snapshot
2. Receive 402 + PAYMENT-REQUIRED header (Base64 JSON)
3. Decode to get price, network, payTo, facilitator
4. Sign x402 payment (USDC on Base, eip155:8453)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The quick-start flow instructs the agent to complete an x402 payment using USDC on Base, but it does not prominently warn that this spends real funds on every paid call. In an agent-skill context, this is dangerous because automated consumers may execute the steps literally and incur unintended financial loss, especially since the instructions are framed as the default onboarding path.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · x402.md (reported line 49)May include surrounding context.

Send a normal GET request to any agent endpoint.

bash
curl -i https://api.hlprivateer.xyz/v1/agent/positions

Step 2: Receive 402 Challenge

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This step instructs users to send a signed payment proof to a remote service but does not tell them to validate the challenge details first. If users blindly sign and submit payment authorizations, a malicious or spoofed endpoint could cause unintended payments, overpayment, or authorization of the wrong recipient/resource.

Content

Scanner excerpt · x402.md (reported line 96)May include surrounding context.

Create a signed payment payload and send it as the PAYMENT-SIGNATURE header (Base64-encoded JSON).

bash
curl -i https://api.hlprivateer.xyz/v1/agent/positions \
  -H "PAYMENT-SIGNATURE: eyJ4NDAyVmVyc2lvbiI6MiwicGF5bG9hZCI6ey..."

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This example sends $SIGNED_PAYMENT directly to the remote endpoint without surrounding safety guidance on challenge verification, amount limits, or secure handling of the signed payload. In a payment protocol, such signed artifacts represent value transfer authorization, so treating them like ordinary headers can lead to accidental disclosure, replay exposure within validity windows, or payment to an unintended target.

Content

Scanner excerpt · x402.md (reported line 168)May include surrounding context.

See https://x402.org for client libraries in TypeScript, Python, etc.

Step 3: Retry with signed payment

curl -s https://api.hlprivateer.xyz/v1/agent/positions
-H "PAYMENT-SIGNATURE: $SIGNED_PAYMENT" | jq .

text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The TypeScript example directly uses a raw private key string (privateKeyToAccount("0x<your-private-key>")) without any warning about secure key handling, wallet isolation, or safer signing alternatives. In a payment-signing workflow, users may copy this pattern into scripts, source files, logs, or shared environments, increasing the chance of wallet compromise and unauthorized fund use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.