ClawHub
Back to skill

Security audit

Snakey

Security checks for vulnerabilities and agentic risk

Overview

This skill supports the advertised crypto game, but it asks an agent to use a wallet private key and paid game actions without enough scoping or safeguards.

Review before installing. Use only a dedicated low-value wallet, avoid primary wallets or keys with unrelated assets, verify the exact SDK package/version, and require explicit confirmation before any mainnet or paid transaction.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:10
Finding

Unpinned Third-Party SDK Receives a Raw Wallet Private Key

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10-20 and 39-48
Vulnerability Type: T08: Insecure Dependencies
Risk Level: High

The skill installs @snakey/sdk without specifying an exact version or integrity hash. It then passes the value of WALLET_PRIVATE_KEY directly to this externally maintained SDK, which performs network communication and signs financial transactions.

Vulnerable configuration at lines 10-20:

json
"openclaw": {
  "emoji": "🐍",
  "requires": {
    "bins": ["node", "npm"],
    "env": ["WALLET_PRIVATE_KEY"]
  },
  "primaryEnv": "WALLET_PRIVATE_KEY",
  "install": [
    {
      "type": "npm",
      "package": "@snakey/sdk",
      "global": false
    }
  ]
}

Private-key use at lines 39-48:

javascript
const client = new SnakeyClient({
  serverUrl: 'https://api.snakey.ai',
  walletAddress: '0x...',
  privateKey: process.env.WALLET_PRIVATE_KEY
});

// Claim free testnet funds ($10 USDC + ETH for gas)
await client.claimFaucet();

// Play a game (handles payment, waiting, everything)
const result = await client.play('MyBot');

Technical Analysis

The npm package reference has no exact version constraint or cryptographic integrity value. Consequently, installation can resolve registry content that changes after the skill has been reviewed. This creates a supply-chain trust boundary around a component that receives a reusable wallet private key and is authorized to conduct network and payment operations.

The audited project contains only SKILL.md; it does not include the SDK implementation. Therefore, the SDK's key handling, transaction validation, destination restrictions, telemetry, and signing scope cannot be independently verified from this artifact. A compromised package release, maintainer account, transitive dependency, or package-registry delivery path could introduce code that reads and transmits the key or sig ...[truncated 1519 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin @snakey/sdk to a specific, reviewed version rather than allowing mutable package resolution.
  2. Enforce lockfile integrity and verify package cryptographic integrity during installation.
  3. Audit and vendor the security-critical SDK source, or otherwise make the exact implementation available alongside the skill for review.
  4. Replace reusable raw private keys with an isolated signer, hardware-backed wallet, or short-lived session key.
  5. Restrict signing authority by chain ID, contract, recipient, token, maximum amount, transaction count, and expiration time.
  6. Require explicit confirmation before every mainnet transaction, displaying the network, recipient, token, amount, calldata, and maximum fee.
  7. Use a dedicated low-balance wallet with no unrelated assets or existing token allowances.
  8. Separate testnet and mainnet configuration explicitly, and reject mainnet execution unless it is deliberately enabled.
  9. Review transitive dependencies and use automated dependency monitoring to detect compromised, deprecated, or unexpectedly changed releases.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly requires a wallet private key and promotes paid wallet actions, but it does not provide a prominent warning about financial loss, irreversible blockchain transactions, or the sensitivity of private keys. In an agent context, this can lead users to grant signing authority or trigger spending without fully understanding that compromise or misuse of the key can drain funds.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The 'quickPlay' flow is described as automatically creating a wallet, claiming funds, and joining a game, but the documentation does not foreground that these are consequential external and financial actions. For an agent skill, automation without an up-front warning increases the chance of unintended wallet creation, external account activity, and paid participation with minimal user awareness.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

Option 3: Direct API

bash
# Claim faucet (gives USDC + ETH)
curl -X POST https://api.snakey.ai/faucet \
  -H "Content-Type: application/json" \
  -d '{"walletAddress": "0x..."}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

Option 3: Direct API

bash
# Claim faucet (gives USDC + ETH)
curl -X POST https://api.snakey.ai/faucet \
  -H "Content-Type: application/json" \
  -d '{"walletAddress": "0x..."}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The command list shows 'snakey join' joins the next game for $3 USDC, but it is presented as a normal command without a strong spending warning. In an agent-operated environment, concise command tables can be treated as safe defaults, so omitting a clear warning raises the risk of accidental fund expenditure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.