ClawHub
Back to skill

Security audit

Overlay Market (perpetual futures trading)

Security checks for vulnerabilities and agentic risk

Overview

This mainnet trading skill is transparent about its purpose, but its bundled signer can approve or send under-validated transactions that could put wallet funds at risk.

Install only if you are comfortable reviewing every transaction before signing. Prefer an external signer or restricted smart account, use a dedicated low-value wallet, avoid unlimited approvals unless intentional, and do not pipe unknown transaction JSON into send.js.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/send.js:39
Finding

Insufficient Transaction Validation Permits Unauthorized USDT Approvals and Arbitrary Shiva Calls

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/unwind.js:38
Finding

Externally Supplied 1inch Swap Calldata Is Incompletely Validated

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (19)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The declared description covers a broad leveraged perpetual futures trading and position-management skill on Overlay Protocol. The supplied code only implements chart/indicator analysis for a single market using external candle data. It does not interact with a wallet, does not build or unwind positions, does not encode transactions, and does not monitor open positions or PnL. While the price-analysis portion is consistent with part of the description, the primary behavior of this specific code chunk is much narrower than the declared end-to-end trading functionality, so this is a description/behavior mismatch for the supplied chunk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared description covers a broad leveraged perpetual futures trading and position-management capability set. However, this code chunk only implements scanning and basic price-change reporting for Overlay markets. It reads public market and price data, formats a console report, and supports a details lookup. There is no wallet access, signing, transaction construction, position retrieval, or PnL logic. While market scanning is one declared sub-capability, the actual code is materially narrower than the declared purpose, so the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md
| Overlay market catalog | `api.overlay.market/data/api/markets` | `scan.js` |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md
| Overlay market catalog | `api.overlay.market/data/api/markets` | `scan.js` |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

md
| Overlay market catalog | `api.overlay.market/data/api/markets` | `scan.js` |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.

md
| Overlay market catalog | `api.overlay.market/data/api/markets` | `scan.js` |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.

md
| Overlay market catalog | `api.overlay.market/data/api/markets` | `scan.js` |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md
| Overlay OHLC candles | `api.overlay.market/bsc-charts/v1/charts` | `chart.js` |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

md
| Overlay OHLC candles | `api.overlay.market/bsc-charts/v1/charts` | `chart.js` |

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.

md
| Overlay OHLC candles | `api.overlay.market/bsc-charts/v1/charts` | `chart.js` |

Known Vulnerable Dependency: ws==8.18.3 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High
Category
Supply Chain
Confidence
97% confidence
Finding

This is a true dependency risk: the lockfile pins ws to 8.18.3, and the reported advisories describe memory disclosure and memory-exhaustion denial of service in that version. In this skill’s context, viem may use ws for blockchain/WebSocket RPC connections, so a malicious or compromised endpoint could potentially trigger crashes, resource exhaustion, or unintended data exposure during market monitoring or trading-related operations.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill explicitly requires environment variables and network access, but it does not declare any tool scope such as permissions or allowed-tools. In an agent setting, this creates an avoidable least-privilege failure: the runtime may grant broader capabilities than users or orchestrators expect, increasing the chance of unintended network use or access to sensitive environment data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The workflow includes live approve, build, unwind, and send examples that can move real funds on BSC, but the example section does not prominently warn that these actions are irreversible and may cause immediate financial loss. In an agent-assisted context, runnable examples without strong safety framing increase the risk of accidental execution against mainnet with real assets.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/common.js (reported line 33)May include surrounding context.

js
export const OVL_TOKEN = "0x1F34c87ded863Fe3A3Cd76FAc8adA9608137C8c3";
export const USDT_TOKEN = "0x55d398326f99059fF775485246999027B3197955";

export const MARKETS_API = "https://api.overlay.market/data/api/markets";
export const CHARTS_API = "https://api.overlay.market/bsc-charts/v1/charts";
export const PRICES_API = "https://api.overlay.market/bsc-charts/v1/charts/marketsPricesOverview";
export const SUBGRAPH_URL = "https://api.goldsky.com/api/public/project_clyiptt06ifuv01ul9xiwfj28/subgraphs/overlay-bsc/prod/gn";

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/common.js (reported line 34)May include surrounding context.

js
export const OVL_TOKEN = "0x1F34c87ded863Fe3A3Cd76FAc8adA9608137C8c3";
export const USDT_TOKEN = "0x55d398326f99059fF775485246999027B3197955";

export const MARKETS_API = "https://api.overlay.market/data/api/markets";
export const CHARTS_API = "https://api.overlay.market/bsc-charts/v1/charts";
export const PRICES_API = "https://api.overlay.market/bsc-charts/v1/charts/marketsPricesOverview";
export const SUBGRAPH_URL = "https://api.goldsky.com/api/public/project_clyiptt06ifuv01ul9xiwfj28/subgraphs/overlay-bsc/prod/gn";

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/common.js (reported line 35)May include surrounding context.

js
export const OVL_TOKEN = "0x1F34c87ded863Fe3A3Cd76FAc8adA9608137C8c3";
export const USDT_TOKEN = "0x55d398326f99059fF775485246999027B3197955";

export const MARKETS_API = "https://api.overlay.market/data/api/markets";
export const CHARTS_API = "https://api.overlay.market/bsc-charts/v1/charts";
export const PRICES_API = "https://api.overlay.market/bsc-charts/v1/charts/marketsPricesOverview";
export const SUBGRAPH_URL = "https://api.goldsky.com/api/public/project_clyiptt06ifuv01ul9xiwfj28/subgraphs/overlay-bsc/prod/gn";

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/common.js (reported line 36)May include surrounding context.

js
export const MARKETS_API = "https://api.overlay.market/data/api/markets";
export const CHARTS_API = "https://api.overlay.market/bsc-charts/v1/charts";
export const PRICES_API = "https://api.overlay.market/bsc-charts/v1/charts/marketsPricesOverview";
export const SUBGRAPH_URL = "https://api.goldsky.com/api/public/project_clyiptt06ifuv01ul9xiwfj28/subgraphs/overlay-bsc/prod/gn";

// ── ABIs ─────────────────────────────────────────────────────────────────────

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
92% confidence
Finding

The dependency uses a caret range (^2.0.0), which allows automatic installation of newer compatible versions. In a security-sensitive trading skill that prepares blockchain transactions and handles wallet-related operations, this increases supply-chain risk because a compromised or breaking upstream release could be pulled in without deliberate review.

Content

Scanner excerpt · package.json (reported line 6)May include surrounding context.

json
"private": true,
  "type": "module",
  "dependencies": {
    "viem": "^2.0.0"
  }
}

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The code explicitly uses toLocaleString("en-US", ...), which imposes a specific locale in user-facing output. Under the policy, locale-specific behavior should be optional or clearly justified; this file provides neither.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/common.js:145