ClawHub
Back to skill

Security audit

Airdrop Alert

Security checks for vulnerabilities and agentic risk

Overview

The skill appears non-malicious but incomplete: it advertises airdrop alerts and asks for Telegram/network setup while the included code only shows static sample results.

Before installing, treat this as a prototype or sample rather than a reliable live airdrop monitor. Only provide a limited Telegram bot token if you are comfortable with future alert functionality, and do not rely on the listed opportunities, deadlines, or eligibility checks as current financial guidance.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill declares external network-related capabilities via required binaries like curl and a Telegram bot token, but it does not define any explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where a host or user may not understand that the skill can make outbound network requests, increasing the risk of unintended data exfiltration or unsafe remote interactions.

Natural-Language Policy Violations

Medium
Confidence
94% confidence
Finding
The pricing descriptions and feature list are presented in Chinese while the rest of the skill file is primarily in English, with no indication that the skill is region-specific or that users can choose their preferred language. This creates a natural-language locale policy issue because the skill imposes a language on users without opt-in or justification.

Natural-Language Policy Violations

Medium
Confidence
97% confidence
Finding
The module description and later user-facing output indicate the skill is designed to communicate in Chinese, but there is no opt-in or language selection mechanism. This can violate language/locale policy when a skill forces a specific language on users by default.

Natural-Language Policy Violations

Medium
Confidence
98% confidence
Finding
The printed wallet-check and airdrop-listing messages are all hard-coded in Chinese, and the file provides no mechanism for users to select another language. Forcing one locale in user-visible strings without choice matches the natural-language policy violation criteria.

Intent-Code Divergence

Low
Confidence
97% confidence
Finding
The function documentation says it will fetch potential airdrops from various sources, and the module defines source URLs above it. In reality, the implementation immediately returns a static in-memory list marked as simulated data, so the documentation actively misstates the behavior.

Static analysis

No suspicious patterns detected.