ClawHub
Back to skill

Security audit

Exfer

Security checks for vulnerabilities and agentic risk

Overview

This cryptocurrency skill is mostly coherent, but it asks users to run unverified downloaded binaries and includes persistent background mining instructions that need careful review.

Review this before installing. Only run the binary after verifying a pinned release, checksum, or signature from a trusted source. Avoid putting wallet passphrases in environment variables on shared or logged systems. Treat all payment and contract examples as real value-bearing actions, and do not enable nohup or LaunchAgent mining unless you intentionally want a persistent background miner and know how to stop and remove it.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T06 · System Persistence

Error
Location
SKILL.md:746
Finding

Persistent Cryptocurrency Miner Installed as a macOS LaunchAgent

Content
View full analysis
\ --rpc-bind 127.0.0.1:9334 \ --repair-perms \ > ~/exfer.log 2>&1 & ``` ```bash cat > ~/Library/LaunchAgents/org.exfer.miner.plist << EOF Labelorg.exfer.miner ProgramArguments $(which exfer || echo ./target/release/exfer) mine --datadir$HOME/.exfer --miner-pubkeyYOUR_PUBKEY_HEX --repair-perms KeepAlive StandardOutPath/tmp/exfer.log StandardErrorPath/tmp/exfer.log EOF launchctl load ~/Library/LaunchAgents/org.exfer.miner.plist ``` ### Technical Analysis The Skill directs the user to create and load a macOS LaunchAgent that executes a cryptocurrency miner. A LaunchAgent survives the original Skill run and starts in later login sessions. The `KeepAlive` property also instructs `launchd` to restart the miner after it exits. Mining is part of the declared Exfer functionality, but cross-session persistence is not required merely to demonstrate or invoke mining. The instructions do not require an explicit persistence confirmation, establish resource limits, or provide corresponding unload and removal commands. The Linux `nohup` example also detaches the miner and keeps it active after the initiating shell exits. Although `nohup` alone does not survive a reboot, it makes resource-consuming execution less visible and harder ...[truncated 1162 chars]
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:62
Finding

Unverified Mutable Release Binaries Are Downloaded for Local Execution

Content
View full analysis
Remediation
View remediation
exfer-linux-x86_64' | sha256sum --check - chmod +x exfer-linux-x86_64 ``` - Do not register the executable as a persistent service until its provenance and integrity have been verified. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:67
Finding

macOS Quarantine Metadata Is Removed from Unverified Executables

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (17)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 321)May include surrounding context.

md
# ── Agent A: lock funds using the hash from Agent B ──
# Get current height to set timeout
HEIGHT=$(curl -s -X POST $RPC \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"get_block_height","params":{},"id":1}' \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['result']['height'])")

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The skill instructs users to download and execute prebuilt binaries directly from the internet without any integrity verification such as checksums, signatures, or pinned release versions. If the release channel, repository, DNS, or transport path is compromised, users or agents could install and run a malicious wallet/miner binary with access to funds and host resources.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

bash
# Linux x86_64
curl -LO https://github.com/ahuman-exfer/exfer/releases/latest/download/exfer-linux-x86_64
chmod +x exfer-linux-x86_64
mv exfer-linux-x86_64 exfer

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill recommends passing the wallet passphrase via an environment variable for automation, but does not warn that environment variables can be exposed through process listings, logs, crash reports, shell history wrappers, or inherited subprocess environments. For an autonomous agent, this increases the chance of secret disclosure and wallet compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This documentation provides direct commands for sending irreversible payments and creating fund-locking contracts, but it does not prominently warn that mistakes can permanently transfer or lock funds. In an agent skill context, this is especially risky because automation may execute these actions without meaningful human confirmation or risk review.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 264)May include surrounding context.

5. Check Transaction Status

bash
curl -s -X POST $RPC \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 321)May include surrounding context.

md
# ── Agent A: lock funds using the hash from Agent B ──
# Get current height to set timeout
HEIGHT=$(curl -s -X POST $RPC \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"get_block_height","params":{},"id":1}' \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['result']['height'])")

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 340)May include surrounding context.

md
# ── Agent A: lock funds using the hash from Agent B ──
# Get current height to set timeout
HEIGHT=$(curl -s -X POST $RPC \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"get_block_height","params":{},"id":1}' \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['result']['height'])")

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 452)May include surrounding context.

md
# ── Agent A: lock funds using the hash from Agent B ──
# Get current height to set timeout
HEIGHT=$(curl -s -X POST $RPC \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","method":"get_block_height","params":{},"id":1}' \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['result']['height'])")

Session Persistence

Medium
Category
Rogue Agent
Confidence
91% confidence
Finding

The documentation explicitly instructs users to run the miner with nohup in the background, establishing long-lived unattended execution. Persistence mechanisms are sensitive in agent environments because they can consume resources continuously, outlive the invoking session, and make unwanted blockchain activity harder to notice or stop.

Content

Scanner excerpt · SKILL.md (reported line 746)May include surrounding context.

Linux:

bash
nohup ./target/release/exfer mine \
  --datadir ~/.exfer \
  --miner-pubkey <YOUR_PUBKEY_HEX> \
  --rpc-bind 127.0.0.1:9334 \

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

The macOS LaunchAgent plist instructions are a persistence mechanism that causes the miner to restart automatically and survive user sessions. In a skill intended for autonomous agents, persistence is materially risky because it can create durable background processes with ongoing CPU, network, and storage effects.

Content

Scanner excerpt · SKILL.md (reported line 756)May include surrounding context.

macOS:

bash
cat > ~/Library/LaunchAgents/org.exfer.miner.plist << EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">

Session Persistence

Medium
Category
Rogue Agent
Confidence
89% confidence
Finding

This plist content is part of configuring automatic miner persistence on macOS. While not covertly malicious, documenting an autorun configuration without strong warnings increases the risk that users or agents enable durable background execution unintentionally.

Content

Scanner excerpt · SKILL.md (reported line 758)May include surrounding context.

bash
cat > ~/Library/LaunchAgents/org.exfer.miner.plist << EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key><string>org.exfer.miner</string>

Session Persistence

Medium
Category
Rogue Agent
Confidence
89% confidence
Finding

This plist content is part of configuring automatic miner persistence on macOS. While not covertly malicious, documenting an autorun configuration without strong warnings increases the risk that users or agents enable durable background execution unintentionally.

Content

Scanner excerpt · SKILL.md (reported line 758)May include surrounding context.

bash
cat > ~/Library/LaunchAgents/org.exfer.miner.plist << EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key><string>org.exfer.miner</string>

Session Persistence

Medium
Category
Rogue Agent
Confidence
89% confidence
Finding

The LaunchAgent program arguments define an auto-starting miner, contributing to session persistence. In context, this is functional documentation, but still a true operational risk because it normalizes installing persistent background jobs on the host.

Content

Scanner excerpt · SKILL.md (reported line 759)May include surrounding context.

md
cat > ~/Library/LaunchAgents/org.exfer.miner.plist << EOF
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key><string>org.exfer.miner</string>
  <key>ProgramArguments</key>

Session Persistence

Medium
Category
Rogue Agent
Confidence
89% confidence
Finding

The plist completion plus subsequent load step are integral to establishing persistence for the miner. Persistent cryptocurrency-related workloads are particularly sensitive because they can continuously consume CPU/network resources and may be difficult for end users to attribute.

Content

Scanner excerpt · SKILL.md (reported line 774)May include surrounding context.

StandardOutPath/tmp/exfer.log StandardErrorPath/tmp/exfer.log EOF launchctl load ~/Library/LaunchAgents/org.exfer.miner.plist

text

Session Persistence

Medium
Category
Rogue Agent
Confidence
93% confidence
Finding

The launchctl load command actively enables a persistent LaunchAgent, making the miner start automatically in future sessions. In an agent skill, this crosses from simple usage guidance into host persistence, which should be treated as a security-sensitive action even if openly documented.

Content

Scanner excerpt · SKILL.md (reported line 776)May include surrounding context.

EOF launchctl load ~/Library/LaunchAgents/org.exfer.miner.plist ```

Check status: curl -s http://127.0.0.1:9334 -d '{"jsonrpc":"2.0","id":1,"method":"get_block_height","params":{}}'

Session Persistence

Medium
Category
Rogue Agent
Confidence
93% confidence
Finding

The launchctl load command actively enables a persistent LaunchAgent, making the miner start automatically in future sessions. In an agent skill, this crosses from simple usage guidance into host persistence, which should be treated as a security-sensitive action even if openly documented.

Content

Scanner excerpt · SKILL.md (reported line 776)May include surrounding context.

EOF launchctl load ~/Library/LaunchAgents/org.exfer.miner.plist ```

Check status: curl -s http://127.0.0.1:9334 -d '{"jsonrpc":"2.0","id":1,"method":"get_block_height","params":{}}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 779)May include surrounding context.

launchctl load ~/Library/LaunchAgents/org.exfer.miner.plist

text

Check status: `curl -s http://127.0.0.1:9334 -d '{"jsonrpc":"2.0","id":1,"method":"get_block_height","params":{}}'`

### Run a non-mining full node