T09 · Insecure Skill Coding Practices
Warning
- Location
strategy-scheduler.js:84- Finding
Wallet Private-Key Prefix Disclosed in Scheduler Logs
- Content
View full analysis
- Remediation
View remediation
Security audit
Clawtrade Bnb
Security checks for vulnerabilities and agentic risk
Overview
This is a real autonomous DeFi trading skill that is mostly purpose-aligned, but it asks for wallet signing authority and can repeatedly submit live transactions without enough safety controls.
Review this carefully before installing. Use only a fresh testnet wallet or a wallet with funds you can afford to lose, do not put a mainnet private key in .env, avoid running the live scheduler unattended, and do not expose the API port to untrusted networks. This should be treated as experimental financial automation until it has bounded approvals, dry-run/manual approval defaults, transaction and gas limits, authenticated APIs, and audited mainnet controls.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
defi-strategy-engine.js:75- Finding
Missing Safety Controls and Undefined Rebalance Result Can Cause Repeated Real Transactions
- Content
View full analysis
0.001) { console.log(` ⚡ Calling compound()...`); const tx = await vaultContract.compound({ gasLimit: 200000 }); console.log(` 📝 TX submitted: ${tx.hash}`); const receipt = await tx.wait(1); ``` ```javascript // defi-strategy-engine.js const userYield = await vaultContract.calculateUserYield(this.wallet.address); const yieldAmount = parseFloat(ethers.utils.formatEther(userYield)); if (yieldAmount > 0.001) { console.log(`\n✓ ${vault.vaultId}: Harvesting ${yieldAmount.toFixed(6)} tokens`); const tx = await vaultContract.harvest({ gasLimit: 200000 }); console.log(` TX: ${tx.hash}`); const receipt = await tx.wait(1); ``` ```javascript // defi-strategy-engine.js async executeFullCycle() { console.log(`\n${'═'.repeat(60)}`); console.log(`DeFi Strategy Engine - REAL Transactions`); console.log(`${new Date().toISOString()}`); console.log(`${'═'.repeat(60)}`); const cycleResults = { timestamp: Date.now(), compound: await this.compoundYieldStrategy(), harvest: await this.harvestStrategy(), }; this.savePerformanceMetrics(); ``` ```javascript // strategy-scheduler.js try { // Run all strategies const results = await engine.executeFullCycle(); // Log to blockchain if (results.compound.length > 0) { for (const action of results.compound) { await logger.logAction ...[truncated 3394 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
pancakeswap-executor.js:49- Finding
PancakeSwap Executor Grants Unlimited Persistent Token Allowance
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
server.js:16- Finding
Unauthenticated API Exposes Wallet and Financial Execution Logs
- Content
View full analysis
{ try { const logPath = path.join(__dirname, 'execution-log.jsonl'); if (!fs.existsSync(logPath)) { return res.json([]); } const content = fs.readFileSync(logPath, 'utf8'); const logs = content .split('\n') .filter(line => line.trim()) .map(line => JSON.parse(line)); res.json(logs); } catch (err) { console.error('Error reading logs:', err); res.status(500).json({ error: err.message }); } }); ``` ```javascript // server.js const PORT = process.env.PORT || 3001; app.listen(PORT, () => { ``` ```javascript // api/logs.js const app = express(); app.use(cors()); app.use(express.json()); // Serve execution logs app.get('/api/logs', (req, res) => { try { const logPath = path.join(__dirname, '../execution-log.jsonl'); if (!fs.existsSync(logPath)) { return res.json([]); } const content = fs.readFileSync(logPath, 'utf8'); const logs = content .split('\n') .filter(line => line.trim()) .map(line => { try { const parsed = JSON.parse(line); // Ensure all fields are safe return { timestamp: parsed.timestamp || 0, cycle: parsed.cycle || 0, action: parsed.action || 'UNKNOWN', vault: parsed.vault || parsed.vault_id || 'unknown', vault_id: parsed.vault_id || parsed.vault || 'unknown', vault_name: parsed.vault_name || '', tx_hash: parsed.tx_hash || '', rewards_usd: parsed.rewards_usd || parsed.amount_tokens || 0, confidence: parse ...[truncated 2918 chars]- Remediation
View remediation
{ console.log(`API listening on http://${HOST}:${PORT}`); }); ``` - Require authentication for every non-health endpoint. For remote deployments, use short-lived tokens or authenticated reverse-proxy identity rather than a static public endpoint. - Enforce authorization so users can only access logs for wallets they are permitted to monitor. - Replace unrestricted CORS with an explicit allowlist: ```javascript app.use(cors({ origin: ['http://localhost:5173'], methods: ['GET'], credentials: false })); ``` - Remove `...parsed` and return only explicitly permitted fields. - Redact wallet addresses where full addresses are unnecessary, and avoid returning raw provider or contract error messages. - Add pagination, maximum response size, rate limiting, and security logging. - Keep port 3001 blocked from untrusted networks unless the authenticated API is intentionally deployed. - Treat CORS only as a browser control, not as a substitute for authentication. ]]>
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (327)
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The report identifies the skill as
yield-farming-agentwhile the manifested skill isclawtrade-bnb, creating a clear identity mismatch. In an autonomous DeFi context, this can mislead operators about what code they are reviewing or deploying, weakening trust boundaries and potentially causing the wrong strategy or artifact to be approved for on-chain use.- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation advertises autonomous real blockchain execution and frequent conditional transactions without a prominent warning about financial risk, gas expenditure, and the possibility of unintended on-chain actions. Because this is a DeFi trading skill, omission of explicit safety warnings materially increases the chance that a user enables automation without understanding that it can submit live transactions affecting funds.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The installation instructions end with running the scheduler but do not clearly warn that doing so may immediately begin autonomous transaction activity. This is especially dangerous in a wallet-connected agent because users may treat the command as a harmless startup step when it can trigger live on-chain behavior and repeated execution cycles.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The document promotes autonomous blockchain transaction execution, including signing with a private wallet and executing deposit/withdraw/harvest/rebalance actions, without prominent warnings about irreversible financial loss, strategy failure, contract risk, or misconfiguration. In a DeFi trading skill context, this omission is dangerous because operators may enable live execution without understanding that the agent can directly move assets and incur losses.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The scheduler is described as running decision cycles automatically and executing blockchain transactions on a timer, but there is no explicit warning about unattended operation risk such as repeated bad trades, runaway retries, stale data, or draining funds during abnormal market conditions. Because this skill is intended for autonomous DeFi operation, lack of strong warnings and guardrails materially increases the chance of user harm.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 92% confidence
- Finding
Instructing users to edit
.envand place a private key there promotes handling long-lived signing material in plaintext environment files. For a trading agent that can auto-execute on-chain actions, compromise of that file directly enables unauthorized transactions and asset theft.- Content
Copy config
cp .env.example .env
Edit .env with your testnet private key
nano .env
(Add PRIVATE_KEY=your_key)
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The explicit instruction
Add PRIVATE_KEY=your_keynormalizes storing a blockchain private key directly in an environment file. In this skill's context, that credential authorizes autonomous trading, so leakage through local compromise, backups, logs, screenshots, or accidental commits can cause immediate fund loss.- Content
cp .env.example .env
Edit .env with your testnet private key
nano .env
(Add PRIVATE_KEY=your_key)
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 92% confidence
- Finding
This line explicitly instructs users to create a .env file containing a private key, which is credential material for a blockchain wallet. In this skill’s context, that credential enables direct financial actions, so normalizing plaintext secret placement without stronger controls increases the chance of credential compromise and unauthorized asset movement.
- Content
Step 4: Set up environment file
bash # Create .env (git-ignored automatically) echo "PRIVATE_KEY=YOUR_TESTNET_PRIVATE_KEY" > .env echo "RPC_URL=https://bsc-testnet.publicnode.com" >> .env
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 89% confidence
- Finding
This verification command reads the private key from environment variables and derives the wallet address, reinforcing a workflow centered on raw private-key handling. Although it prints only the address, it encourages loading highly sensitive credentials into a general-purpose runtime and may be copied into unsafe environments, increasing exposure risk for a key that controls financial assets.
- Content
bash # Create .env (git-ignored automatically) echo "PRIVATE_KEY=YOUR_TESTNET_PRIVATE_KEY" > .env echo "RPC_URL=https://bsc-testnet.publicnode.com" >> .env # Verify (should show your address) node -e "require('dotenv').config(); const ethers = require('ethers'); const w = new ethers.Wallet(process.env.PRIVATE_KEY); console.log('Wallet:', w.address)"
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 87% confidence
- Finding
Documenting the project structure with a .env file labeled as containing 'Your secrets' normalizes keeping sensitive wallet material in the repository workspace. In a DeFi agent context, this increases the likelihood that users store operational keys beside code, logs, and tooling where they may be accidentally backed up, shared, or exfiltrated by local compromise.
- Content
text clawtrade-bnb/ ├── .env # Your secrets (git-ignored) ├── .network.json # Network preference (auto-created) ├── execution-log.jsonl # Action history (auto-created) ├── performance-metrics.json # Metrics (auto-created)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 93% confidence
- Finding
This troubleshooting advice again instructs users to place a private key directly into a .env file, reinforcing insecure secret-handling habits. Repetition matters here because the skill is an autonomous financial agent, so any compromise of that key can immediately translate into unauthorized transactions and asset loss.
- Content
Issue: "PRIVATE_KEY is not defined"
Solution: Create
.envfile withPRIVATE_KEY=your_keybash echo "PRIVATE_KEY=0x..." > .envIssue: "Cannot find module 'ethers'"
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The guide encourages moving an autonomous trading agent from testnet to mainnet and adding a real private key, while offering only a minimal cautionary note. In the context of an autonomous DeFi agent with network switching and self-optimizing behavior, this can lead users to expose real funds to unreviewed code, strategy bugs, malicious dependencies, or unsafe transactions, creating severe risk of irreversible financial loss.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 99% confidence
- Finding
This line explicitly tells users to add a real mainnet private key to a .env file, which is highly dangerous because it combines plaintext credential storage with production financial authority. In the context of an autonomous DeFi agent, compromise of that file could permit immediate, irreversible theft or misuse of real assets.
- Content
node agent-cli.js network mainnet
Add real contracts to config.deployed.json
Add real private key to .env (mainnet key)
Run with caution - this is real money!
text
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md cat > .gitignore << 'EOF' node_modules/ .env .env.local *.log .DS_Store dist/
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md cat > .gitignore << 'EOF' node_modules/ .env .env.local *.log .DS_Store dist/
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill description makes strong claims about autonomous DeFi trading, network switching, and reinforcement learning, while the analyzed implementation evidence appears inconsistent and in many places limited to logging, dashboards, testing, vault operations, or transaction utilities. This mismatch is dangerous because users may grant wallet keys, enable automation, or run on mainnet under false assumptions about what the software actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill description makes strong claims about autonomous DeFi trading, network switching, and reinforcement learning, while the analyzed implementation evidence appears inconsistent and in many places limited to logging, dashboards, testing, vault operations, or transaction utilities. This mismatch is dangerous because users may grant wallet keys, enable automation, or run on mainnet under false assumptions about what the software actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill description makes strong claims about autonomous DeFi trading, network switching, and reinforcement learning, while the analyzed implementation evidence appears inconsistent and in many places limited to logging, dashboards, testing, vault operations, or transaction utilities. This mismatch is dangerous because users may grant wallet keys, enable automation, or run on mainnet under false assumptions about what the software actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill description makes strong claims about autonomous DeFi trading, network switching, and reinforcement learning, while the analyzed implementation evidence appears inconsistent and in many places limited to logging, dashboards, testing, vault operations, or transaction utilities. This mismatch is dangerous because users may grant wallet keys, enable automation, or run on mainnet under false assumptions about what the software actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill description makes strong claims about autonomous DeFi trading, network switching, and reinforcement learning, while the analyzed implementation evidence appears inconsistent and in many places limited to logging, dashboards, testing, vault operations, or transaction utilities. This mismatch is dangerous because users may grant wallet keys, enable automation, or run on mainnet under false assumptions about what the software actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill description makes strong claims about autonomous DeFi trading, network switching, and reinforcement learning, while the analyzed implementation evidence appears inconsistent and in many places limited to logging, dashboards, testing, vault operations, or transaction utilities. This mismatch is dangerous because users may grant wallet keys, enable automation, or run on mainnet under false assumptions about what the software actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill description makes strong claims about autonomous DeFi trading, network switching, and reinforcement learning, while the analyzed implementation evidence appears inconsistent and in many places limited to logging, dashboards, testing, vault operations, or transaction utilities. This mismatch is dangerous because users may grant wallet keys, enable automation, or run on mainnet under false assumptions about what the software actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill description makes strong claims about autonomous DeFi trading, network switching, and reinforcement learning, while the analyzed implementation evidence appears inconsistent and in many places limited to logging, dashboards, testing, vault operations, or transaction utilities. This mismatch is dangerous because users may grant wallet keys, enable automation, or run on mainnet under false assumptions about what the software actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill description makes strong claims about autonomous DeFi trading, network switching, and reinforcement learning, while the analyzed implementation evidence appears inconsistent and in many places limited to logging, dashboards, testing, vault operations, or transaction utilities. This mismatch is dangerous because users may grant wallet keys, enable automation, or run on mainnet under false assumptions about what the software actually does.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill description makes strong claims about autonomous DeFi trading, network switching, and reinforcement learning, while the analyzed implementation evidence appears inconsistent and in many places limited to logging, dashboards, testing, vault operations, or transaction utilities. This mismatch is dangerous because users may grant wallet keys, enable automation, or run on mainnet under false assumptions about what the software actually does.
- Content
Static analysis
Detected: suspicious.dangerous_exec, suspicious.exposed_secret_literal
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- src/cli.js:34
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- contracts/DEPLOYMENT.md:109
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- demo-executor.js:28
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- pancakeswap-agent.js:27
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- strategy-scheduler.js:23