Security audit

Weave Crypto Invoices

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its crypto invoicing purpose, but its install and publishing helper paths run unpinned third-party packages, which is risky for payment-related workflows.

Review this skill before installing in a wallet, payment, or release environment. Prefer pinned, reviewed versions of the Weave CLI and helper tools, run publishing scripts only in a clean environment with minimal credentials, and manually verify wallet, refund, and deposit addresses before acting on payment instructions.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:83
Finding: Unpinned Third-Party Packages Are Downloaded and Executed
Content: View full analysis
Vulnerability Details

File Locations:

SKILL.md:83-93

scripts/check-skills-sh.sh:41-48

scripts/publish-clawhub.sh:32-34

Vulnerability Type: Unpinned third-party dependencies and automatically accepted remote package execution
Risk Level: Medium

Vulnerable Code

From SKILL.md:83-93:

bash
If `weave` is missing, provide compliant install guidance and ask before running: ```bash go install github.com/AryanJ-NYC/weave-cash/apps/cli/cmd/weave@latest weave --help

If Go is unavailable, use npm fallback:

bash
npm i -g weave-cash-cli weave --help

text
From `scripts/check-skills-sh.sh:41-48`: ```bash npm_config_cache="${npm_cache_dir}" npx -y skills add "${source_spec}" --list echo "Searching skills index for '${query}'..." npm_config_cache="${npm_cache_dir}" npx -y skills find "${query}" if [[ "${run_install_check}" == "1" ]]; then echo "Running optional install smoke check for agent '${agent_name}'..." npm_config_cache="${npm_cache_dir}" npx -y skills add "${source_spec}" --yes --agent "${agent_name}" fi

From scripts/publish-clawhub.sh:32-34:

bash
if command -v npx >/dev/null 2>&1; then export NPM_CONFIG_CACHE="${NPM_CONFIG_CACHE:-/tmp/npm-cache}" clawhub_cmd=(npx -y clawhub)

Technical Analysis

The Go installation command uses the mutable @latest selector, while the npm installation and npx invocations do not specify exact package versions. Consequently, the effective code downloaded and executed can change after this Skill has been reviewed.

The npx -y option automatically accepts package installation without interactive confirmation. These commands therefore establish a supply-chain execution path from public package registries to the local system. No lockfile, package integrity value, immutable commit, or reviewed version constraint is used.

This is particularly sensitive because the Weave CLI process ...[truncated 1837 chars]
Remediation: View remediation
Remediation Suggestions

Replace @latest with a reviewed, immutable Go module version:

bash
go install github.com/AryanJ-NYC/weave-cash/apps/cli/cmd/weave@vX.Y.Z

Pin the npm package to an exact reviewed version:

bash
npm install --global --save-exact weave-cash-cli@X.Y.Z

Pin every npx tool invocation:

bash
npx -y skills@X.Y.Z add "${source_spec}" --list npx -y skills@X.Y.Z find "${query}" npx -y clawhub@X.Y.Z publish ...

Review package provenance, publisher identity, checksums, signatures, and release notes before updating pinned versions.

Use lockfiles and integrity metadata wherever the package workflow supports them.

Run dependency-backed publication tooling in an isolated, least-privileged environment with only the credentials required for the immediate operation.

Avoid exposing wallet secrets, private keys, unrelated credentials, or long-lived publication tokens to package installation processes.

Introduce an explicit dependency-update process in which version changes are reviewed and tested before merging.

T09 · Insecure Skill Coding Practices

Note

Location: scripts/security-check.sh:59
Finding: Predictable Shared Temporary File Allows Symlink Clobbering and Check Interference
Content: View full analysis
Vulnerability Details

File Location: scripts/security-check.sh:59-61, 92-96
Vulnerability Type: Unsafe predictable temporary file usage
Risk Level: Low

Vulnerable Code

From scripts/security-check.sh:55-64:

bash
fail_match() { local label="$1" local pattern="$2" if run_search "${pattern}" "${skill_dir}" "/tmp/weave-security-check.out"; then echo "FAIL: ${label}" >&2 cat /tmp/weave-security-check.out >&2 echo >&2 failures=$((failures + 1)) fi }

From scripts/security-check.sh:80-99:

bash
awk ' { line = $0 if (match(line, /^[[:space:]-]*kind:[[:space:]]*[A-Za-z0-9_]+/)) { value = line sub(/^[[:space:]-]*kind:[[:space:]]*/, "", value) sub(/[[:space:]].*$/, "", value) if (value != "brew" && value != "node" && value != "go" && value != "uv") { print FNR ":" line } } } ' "${skill_md}" >/tmp/weave-security-check.out if [[ -s /tmp/weave-security-check.out ]]; then echo "FAIL: Detected unsupported install kind (allowed: brew|node|go|uv)." >&2 cat /tmp/weave-security-check.out >&2 echo >&2 failures=$((failures + 1)) fi

Technical Analysis

The security check writes repeatedly to the fixed path /tmp/weave-security-check.out. The system temporary directory is normally writable by other local users. The script does not securely create the file, verify that it is a regular file, reject symbolic links, assign a unique per-process name, or remove it after execution.

Shell output redirection follows symbolic links. A local attacker can therefore pre-create the predictable path as a symbolic link to another file writable by the victim. When the victim runs the script, redirection can truncate or overwrite that target with search output.

The shared filename also creates a race condition between concurrent executions. One process can re ...[truncated 1570 chars]
Remediation: View remediation
Remediation Suggestions

Create a unique temporary file securely with mktemp:

bash
umask 077 output_file="$(mktemp "${TMPDIR:-/tmp}/weave-security-check.XXXXXX")" trap 'rm -f -- "${output_file}"' EXIT

Replace every occurrence of /tmp/weave-security-check.out with "${output_file}".

Keep the temporary path quoted in all reads, writes, and cleanup operations.

Fail immediately if secure temporary-file creation fails:

bash
output_file="$(mktemp "${TMPDIR:-/tmp}/weave-security-check.XXXXXX")" || { echo "Error: unable to create a secure temporary file." >&2 exit 1 }

Prefer capturing small command output directly in a shell variable when practical, which eliminates the temporary file entirely.

Add concurrent-execution and pre-existing-symlink tests to verify that one check cannot overwrite or influence another.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/publishing.md (reported line 72)May include surrounding context.
md
--publish-clawhub Publish after checks --no-publish-clawhub Explicitly disable publish --check-skills-sh Run skills.sh listing verification (default: on) --no-check-skills-sh Skip skills.sh listing verification --skills-install-smoke Include skills.sh install smoke check --run-quick-validate Run quick_validate.py when available --no-run-quick-validate Explicitly disable quick validation

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/publishing.md (reported line 82)May include surrounding context.
md
--publish-clawhub Publish after checks --no-publish-clawhub Explicitly disable publish --check-skills-sh Run skills.sh listing verification (default: on) --no-check-skills-sh Skip skills.sh listing verification --skills-install-smoke Include skills.sh install smoke check --run-quick-validate Run quick_validate.py when available --no-run-quick-validate Explicitly disable quick validation

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/release.sh (reported line 24)May include surrounding context.
sh
--publish-clawhub Publish after checks --no-publish-clawhub Explicitly disable publish --check-skills-sh Run skills.sh listing verification (default: on) --no-check-skills-sh Skip skills.sh listing verification --skills-install-smoke Include skills.sh install smoke check --run-quick-validate Run quick_validate.py when available --no-run-quick-validate Explicitly disable quick validation

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/release.sh (reported line 92)May include surrounding context.
sh
--publish-clawhub Publish after checks --no-publish-clawhub Explicitly disable publish --check-skills-sh Run skills.sh listing verification (default: on) --no-check-skills-sh Skip skills.sh listing verification --skills-install-smoke Include skills.sh install smoke check --run-quick-validate Run quick_validate.py when available --no-run-quick-validate Explicitly disable quick validation

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 85% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/release.sh (reported line 188)May include surrounding context.
sh
--publish-clawhub Publish after checks --no-publish-clawhub Explicitly disable publish --check-skills-sh Run skills.sh listing verification (default: on) --no-check-skills-sh Skip skills.sh listing verification --skills-install-smoke Include skills.sh install smoke check --run-quick-validate Run quick_validate.py when available --no-run-quick-validate Explicitly disable quick validation

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/scenarios.md (reported line 103)May include surrounding context.
text
- if both Go and npm are unavailable, report missing prerequisites clearly - do not auto-execute install commands ## Manual Prompt Test Matrix

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The script executes npx -y skills without pinning an exact package version, so it may fetch and run whatever version is current at execution time. That creates a supply-chain risk: a compromised, typo-squatted, or newly published malicious package version could execute arbitrary code in the user's environment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: This invocation again runs npx -y skills without a pinned version, allowing remote package resolution at runtime. Even though this path is only performing a search operation, the risk occurs before the command logic: installing/executing an unpinned package can lead to arbitrary code execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The script's optional install smoke check performs a system-modifying/package installation action when RUN_INSTALL_CHECK=1, but it does not present a clear warning that enabling this mode may install software and alter the local environment. In security-sensitive workflows, this can lead to users triggering side effects they did not fully understand, especially because the command also targets a remote package source.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The optional smoke-check path invokes npx -y skills unpinned while also performing an installation action, compounding the risk. A malicious or compromised package version could both execute arbitrary code and make persistent changes during the install flow.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The script falls back to executing 'npx -y clawhub' without pinning a specific package version, which causes the latest package version to be resolved at runtime. That creates a supply-chain risk: a compromised or malicious newly published version could be executed during release/publish operations, especially dangerous because this script is used in a publishing workflow and likely runs with repository and possibly registry credentials available.
Content: No source excerpt is available for this finding.

Scope Creep

Low

Category: Excessive Agency
Confidence: 70% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · LICENSE.txt (reported line 592)May include surrounding context.
text
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF

Scope Creep

Low

Category: Excessive Agency
Confidence: 70% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · LICENSE.txt (reported line 604)May include surrounding context.
text
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T08 · Insecure Dependencies

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Vulnerable Code

Technical Analysis

Remediation Suggestions

SkillSpector

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Tool Parameter Abuse

Rp1

Rp1

Rp1

Autonomous Decision Making

Rp1

Rp1

Missing User Warnings

Rp1

Rp1

Rp1

Rp1

Scope Creep

Scope Creep

Static analysis