ClawHub
Back to skill

Security audit

ZeroEx Swap

Security checks for vulnerabilities and agentic risk

Overview

This 0x swap skill is not deceptive, but it can spend real wallet funds automatically with weak transaction checks, so it needs user review before installation.

Install only if you are comfortable reviewing and controlling each transaction yourself. Use a dedicated low-balance wallet, avoid exporting a valuable private key in shared shells, verify RPC chain and token decimals, inspect quote destination/data/value before signing, and prefer a pinned lockfile plus a dry-run/confirmation workflow before using real funds.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
swap.js:67
Finding

Unsafe Validation and Construction of Real-Funds Swap Transactions

Content
View full analysis
bal) { throw new Error('Insufficient token balance'); } const allowance = await token.allowance(wallet.address, quote.to); if (BigInt(allowance) < BigInt(sellAmount)) { const approveTx = await token.approve(quote.to, sellAmount); await approveTx.wait(); } } const tx = { to: quote.to, data: quote.data, value: quote.value || '0', gasLimit: quote.gas || '250000' }; const resp = await w ...[truncated 3678 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
package.json:11
Finding

Non-Reproducible Installation of Security-Sensitive Dependencies

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (17)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The setup instructions tell the user to export a raw PRIVATE_KEY but do not prominently warn that this is a highly sensitive credential which grants direct control over funds. In practice, users may place the key in shell history, shared terminals, logs, or persistent environment files, increasing the chance of wallet compromise and theft.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README provides direct commands to execute swaps but does not clearly warn that running the swap command can submit real on-chain transactions and spend real funds irreversibly. In an agent-skill context, concise copy-paste usage examples can cause users or automations to invoke the command without appreciating wallet, slippage, gas, and settlement risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

getSwapTrades

bash
curl -s "https://api.0x.org/trade-analytics/swap?chainId=8453&taker=0xYOUR_WALLET" \
  -H "0x-api-key: $ZEROEX_API_KEY" \
  -H "0x-version: v2"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md
const sellAmount = ethers.parseUnits(amount.toString(), decimals).toString();
  
  // Use v2 API with Permit2
  const url = `https://api.0x.org/swap/permit2/quote?${new URLSearchParams({
    sellToken: sellAddr,
    buyToken: buyAddr,
    sellAmount,

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md
const sellAmount = ethers.parseUnits(amount.toString(), decimals).toString();
  
  // Use v2 API with Permit2
  const url = `https://api.0x.org/swap/permit2/quote?${new URLSearchParams({
    sellToken: sellAddr,
    buyToken: buyAddr,
    sellAmount,

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md
const sellAmount = ethers.parseUnits(amount.toString(), decimals).toString();
  
  // Use v2 API with Permit2
  const url = `https://api.0x.org/swap/permit2/quote?${new URLSearchParams({
    sellToken: sellAddr,
    buyToken: buyAddr,
    sellAmount,

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md
const sellAmount = ethers.parseUnits(amount.toString(), decimals).toString();
  
  // Use v2 API with Permit2
  const url = `https://api.0x.org/swap/permit2/quote?${new URLSearchParams({
    sellToken: sellAddr,
    buyToken: buyAddr,
    sellAmount,

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · quote.js (reported line 92)May include surrounding context.

js
const sellAmount = ethers.parseUnits(amount.toString(), decimals).toString();
  
  // Use v2 API with Permit2
  const url = `https://api.0x.org/swap/permit2/quote?${new URLSearchParams({
    sellToken: sellAddr,
    buyToken: buyAddr,
    sellAmount,

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · swap.js (reported line 96)May include surrounding context.

js
const sellAmount = ethers.parseUnits(amount.toString(), decimals).toString();
  
  // Use v2 API with Permit2
  const url = `https://api.0x.org/swap/permit2/quote?${new URLSearchParams({
    sellToken: sellAddr,
    buyToken: buyAddr,
    sellAmount,

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
80% confidence
Finding

The code reads PRIVATE_KEY/ZEROEX_PRIVATE_KEY and uses it to instantiate a signing wallet, which is a highly sensitive operation. Although the header lists required environment variables, it does not warn users about the risks of supplying a live private key or recommend safer alternatives.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code claims to verify exact token allowance before approving, but the ABI used to construct the token contract does not declare an allowance function. As written, the allowance check will fail at runtime or behave inconsistently, undermining the stated safety control and potentially causing failed swaps or prompting unsafe ad hoc fixes around approvals.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script signs and submits the swap transaction immediately after obtaining the quote, with no interactive confirmation or final presentation of material transaction details. In a tool that directly uses a live private key, this increases the risk of accidental irreversible asset transfers due to bad parameters, manipulated environment/input, or unexpected quote contents.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The dependency is specified with a caret range (^1.7.0), which allows automatic installation of newer minor and patch releases instead of a single audited version. This weakens supply-chain reproducibility and can unexpectedly introduce vulnerable or malicious code if an upstream release is compromised.

Content

Scanner excerpt · package.json (reported line 12)May include surrounding context.

json
"swap": "node swap.js"
  },
  "dependencies": {
    "axios": "^1.7.0",
    "ethers": "^6.13.0",
    "viem": "^2.19.0"
  }

Unverifiable Dependency: axios has 16 known advisory(ies) (CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
78% confidence
Finding

Axios has known advisories, and because the manifest does not pin an exact version, it is not possible to verify from this file whether the installed release includes fixes. In a token-swap integration that likely makes remote API calls, a vulnerable HTTP client could increase risk such as SSRF, proxy bypass, or response-handling abuse depending on usage.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The ethers dependency is not pinned to an exact release and uses a caret range, so different installations may resolve to different versions over time. In a blockchain-integrated skill, this can alter transaction-building or signing behavior unexpectedly and increases supply-chain risk.

Content

Scanner excerpt · package.json (reported line 13)May include surrounding context.

json
},
  "dependencies": {
    "axios": "^1.7.0",
    "ethers": "^6.13.0",
    "viem": "^2.19.0"
  }
}

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The viem package is declared with a non-exact version range, allowing future compatible releases to be installed without review. This creates a software supply-chain exposure and makes builds non-reproducible, which is especially undesirable in code handling token swaps.

Content

Scanner excerpt · package.json (reported line 14)May include surrounding context.

json
"dependencies": {
    "axios": "^1.7.0",
    "ethers": "^6.13.0",
    "viem": "^2.19.0"
  }
}

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The inline comment states that any non-known token will be assumed to already be an address, but the rest of the code separately treats 'ETH' as a symbol when computing decimals and does not translate it to a valid token/address form before constructing the API request. This creates an intent/code mismatch because the comment implies a generic fallback that is not actually safe for all symbolic inputs the code appears to support.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
quote.js:53

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
swap.js:35