ClawHub
Back to skill

Security audit

Crypto Market

Security checks for vulnerabilities and agentic risk

Overview

This crypto-market skill is coherent and purpose-aligned, with ordinary public CoinGecko requests and no persistence, but users should note the unpinned dependency and one overstated portfolio-tracking claim.

Install in a virtual environment or container, consider pinning requests before use, and treat outputs as market data only, not financial advice. Invoke it for crypto-specific requests and be aware it queries CoinGecko over the network.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Note
Location
scripts/requirements.txt:1
Finding

Unbounded Third-Party Dependency Permits Unreviewed Future Releases

Content
View full analysis

Vulnerability Details

File Location: scripts/requirements.txt:1 and SKILL.md:21-25
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Low

Vulnerable Code

scripts/requirements.txt:1:

text
requests>=2.28.0

SKILL.md:21-25:

bash
## Setup

Install dependencies first:

pip install -r scripts/requirements.txt

Technical Analysis

The dependency specification applies only a minimum version constraint. Consequently, the documented installation command may resolve and install any future version of requests that satisfies requests>=2.28.0, even if that version has not been reviewed or tested by the project maintainers.

This produces non-reproducible installations and expands supply-chain exposure. If a future permitted release or its distribution channel were compromised, malicious behavior could be introduced without any modification to this repository. The audit found no evidence that the current requests package is malicious; the risk arises from accepting unreviewed future versions.

Attack Path

  1. An attacker compromises a future requests release, a maintainer account, or the relevant package distribution channel.
  2. The compromised release is published with a version greater than or equal to 2.28.0.
  3. A user follows the documented setup procedure and runs pip install -r scripts/requirements.txt.
  4. Pip resolves the compromised version because it satisfies the open-ended version constraint.
  5. Malicious package code executes during installation or when one of the Skill scripts imports and uses requests.

This path depends on an upstream supply-chain compromise and is not directly exploitable solely through inputs accepted by the audited scripts.

Impact Assessment

Malicious dependency code could execute with the privileges of the account running pip or the Skill. Depending on that account's permissions, it could read or modify a ...[truncated 350 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the open-ended requirement with an exact, reviewed version:
    text
    requests==<reviewed-version>
  2. Generate and commit a lock file containing all transitive dependencies.
  3. Require package hashes during installation, for example by maintaining a hash-locked requirements file and installing with:
    bash
    pip install --require-hashes -r scripts/requirements.txt
  4. Perform dependency upgrades through a reviewed process that includes vulnerability scanning, compatibility tests, and verification of package provenance.
  5. Run installation and execution in an isolated virtual environment or restricted container under a non-privileged account.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The code’s core behavior is limited to searching coins and fetching current market snapshots from CoinGecko’s /search and /simple/price endpoints. This supports live prices, market cap, volume, and optional 24h change, which aligns with part of the description. However, the declared description materially overstates the functionality by claiming historical trends, price history, comparative analysis, and portfolio tracking, none of which are present in the code. There are no undeclared sensitive capabilities, but the declared purpose does not accurately represent the full set of claimed features, so this is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The code does use the declared CoinGecko API and outputs structured JSON about cryptocurrency market data, so the general domain is accurate. However, the description materially overstates the implemented functionality. The script only retrieves current market overview data from /coins/markets and optional global stats from /global. It does not fetch historical trends or price history, does not implement portfolio tracking, and does not perform substantive comparative analysis beyond returning sortable top-coin listings. Its primary purpose is a top-cryptocurrency market overview, not the broader crypto analytics capability claimed in the description.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The code is clearly related to cryptocurrency data and does use the CoinGecko API, so the domain is aligned. However, the declared description significantly overstates the implemented functionality. This script is narrowly focused on historical price/volume retrieval for one coin and optional trend analysis. It does not implement live price lookup, market cap retrieval, multi-coin comparison, or portfolio tracking, all of which are explicitly claimed in the description. There are no concerning undeclared external resources beyond CoinGecko, but the primary purpose is materially narrower than declared, so this should be flagged as a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The example trigger phrase "Give me a market overview" is broad and maps to a very common conversational request, which can cause this skill to activate in situations where a user did not specifically intend to invoke crypto analysis. Because the skill can steer the agent into fetching and presenting financial market data, overbroad triggering increases the risk of misrouting general requests into financial-content workflows and producing irrelevant or unintended outputs.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/coin_compare.py (reported line 10)May include surrounding context.

python
import time
import requests

API_BASE = "https://api.coingecko.com/api/v3"
HEADERS = {"User-Agent": "crypto-market-agent-skill/1.0"}

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/fetch_prices.py (reported line 10)May include surrounding context.

python
import time
import requests

API_BASE = "https://api.coingecko.com/api/v3"
HEADERS = {"User-Agent": "crypto-market-agent-skill/1.0"}

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/market_overview.py (reported line 9)May include surrounding context.

python
import time
import requests

API_BASE = "https://api.coingecko.com/api/v3"
HEADERS = {"User-Agent": "crypto-market-agent-skill/1.0"}

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/price_history.py (reported line 9)May include surrounding context.

python
import time
import requests

API_BASE = "https://api.coingecko.com/api/v3"
HEADERS = {"User-Agent": "crypto-market-agent-skill/1.0"}

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

This code sends data to an external service using requests.get, but the runtime behavior provides no user-facing notice such as a print/log message or confirmation prompt when the network call occurs. Although the module docstring mentions CoinGecko data, the execution path itself does not disclose that user-provided coin selections and query parameters are transmitted off-system.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency is specified as requests>=2.28.0, which allows installation of many future and past-compatible versions without ensuring a reviewed, known-safe release. This weakens supply-chain control and makes builds non-reproducible, increasing the chance that a vulnerable or behavior-changing version of requests is installed later.

Content

Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.

text
requests>=2.28.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
92% confidence
Finding

Because the manifest does not pin requests to a specific version, it is impossible to verify whether the installed package includes fixes for known advisories affecting some requests releases. In a network-facing skill that fetches external market data, this uncertainty matters more because the library is directly used for outbound HTTP interactions where library flaws could affect confidentiality or request handling.

Content

No source excerpt is available for this finding.