Security audit

EOLAS MCP

Security checks for vulnerabilities and agentic risk

Overview

This skill is clearly for trading and social posting, but it grants live financial and public-account authority through unpinned packages and does not document strong user controls.

Review this carefully before installing. Use only accounts and wallets with limited funds and narrowly scoped, revocable tokens; avoid enabling social or media tokens unless needed. Confirm whether the gateway enforces approval prompts before placing trades, moving funds, swapping tokens, closing positions, or posting publicly, and prefer pinned package versions or verified releases for the MCP servers.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

Location: SKILL.md:14
Finding: Unpinned Third-Party Packages Are Installed Globally and Executed Automatically
Content: View full analysis
**Note:** Requires `eolas-edge-mcp >= 2.0.2` for Node v20+ compatibility. > If on an older version, run: `npm install -g eolas-edge-mcp@latest` ``` From `README.md:144-146`: ```markdown ## How It Works The plugin spawns `eolas-edge-mcp` and `eolas-reach-mcp` as child processes when the OpenClaw gateway starts. It communicates with them via the MCP stdio protocol, discovers all available tools, and registers each one as a native OpenClaw agent tool. Credentials are stored in `~/.openclaw/eolas/keychain.json`. ``` ### Technical Analysis The installation instructions use package names without exact versions or integrity hashes and explicitly recommend the mutable `@latest` tag. Consequently, the code installed by following these instructions may differ from the code reviewed or tested by the Skill publisher. The packages are installed globally and subsequently spawned as child processes whenever the OpenClaw gateway starts. This gives the selected package releases an ongoing code-execution channel under the gateway user's operating-system account. The artifact contains only documentation and does not include the source code, lockfiles, checksums, signatures, or package provenance needed to verify the behavior of: - `eolas-openclaw-mcp` - `eolas-edge-mcp` - `eolas-reach-mcp` The child processes expose financially an ...[truncated 2807 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

YARA rule 'ransomware_behavior': Ransomware-like patterns (mass encryption, ransom notes) [malware]

Critical

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · README.md (reported line 140)May include surrounding context.
md
nerate_seedance_video` | Generate video | --- ## Quick Start **1. Fund your trading wallet** Ask your agent: *"What is my trading wallet address?"* Send USDC (Base network) to that address. **2. Deposit to Orderly** > *"Deposit $20 to my Orderly account"* **3. Trade** > *"Long BTC with $15, 3% stop loss"* > *"Show my open positions"* > *"Close everything"* **4. Post about it** > *"Send a Telegram message: EOLAS just longed BTC at $X"* --- ## How It Works The plugin spawns `eolas-edge-mcp` and `eolas-reach-mcp` as child processes when the OpenClaw gateway starts. It communicates with them via the MCP stdio protocol, discovers all available tools, and registers each one as a native OpenClaw agent tool. Credentials are stored in `~/.openclaw/eolas/keychain.json`. --- ## Links - [EOLAS DEX](https://perps.eolas.fun) — trade directly - [EOLAS Docs](https://eolas.gitbook.io/eolas) — full documentation - [OpenClaw](https://openclaw.ai) — AI agent platform - [ClawHub

YARA rule 'ransomware_behavior': Ransomware-like patterns (mass encryption, ransom notes) [malware]

Critical

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.
md
nclaw/eolas/keychain.json` on first use. No credentials are sent anywhere except to the EOLAS API (`api.orderly.org`). ## Trading - "What markets are available on EOLAS?" - "Show me the BTC funding rate" - "Long ETH with $20, 3% stop loss, 6% take profit" - "Show my open positions" - "Close my BTC position" - "What is my account balance?" - "Scan markets for the best opportunity" ## Social - "Send a Telegram message: BTC just hit $X" - "Post a tweet about this trade" - "Get my latest Twitter mentions" - "Generate an image for this signal" ## Tools **Trading (13 tools via EOLAS Edge → Orderly Network, Base mainnet)** - `eolas_get_markets` — list all markets - `eolas_get_market_info` — price, funding rate, open interest - `eolas_get_account_balance` — account balance - `eolas_get_positions` — open positions - `eolas_get_orders` — order history - `eolas_get_tradingview_candles` — OHLCV data - `eolas_place_order` — market or limit order - `eolas_place_bracket_order`

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README promotes live financial and destructive account actions such as funding wallets, placing leveraged trades, and using 'close everything' without explicit warnings, confirmation requirements, or risk disclosures. In an agent-tool context, users may treat these examples as safe defaults, increasing the chance of accidental loss from autonomous or misunderstood execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The README advertises posting to X/Twitter, sending Telegram messages, and reading mentions or Telegram updates without privacy, consent, or account-action warnings. In an agent setting, this can lead to unintended publication, disclosure of sensitive information, or unauthorized monitoring of inbound messages if users do not understand the scope of access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill exposes examples and tool descriptions for high-impact actions such as placing trades, withdrawing funds, closing positions, and posting to public social accounts without any embedded warnings, confirmation requirements, or guardrails. In an agent setting, this increases the risk of accidental or prompt-induced execution of financially or reputationally harmful actions, especially because the skill combines market actions with authenticated social posting.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.