ClawHub
Back to skill

Security audit

eden-digital-web3-weekly-digest

Security checks for vulnerabilities and agentic risk

Overview

This skill is a public Web3 weekly-report assistant that fetches public market/news data and does not request credentials, persistence, or local data access.

Install this if you want an assistant to gather public Web3 news and market data for weekly report drafting. Be aware that it may run web searches or public API requests when a Web3-related weekly-report request is implied; review fetched facts before publishing financial or regulatory summaries.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Vague Triggers

High
Confidence
96% confidence
Finding
The skill’s activation rules are unusually broad and include vague phrases like “帮我写本周的” whenever surrounding context touches Web3-related topics. This can cause unintended auto-activation on ordinary editorial or research requests, leading the agent to start network-fetching and data-collection behavior the user may not have explicitly requested.

External Script Fetching

High
Category
Supply Chain
Content
```bash
# 抓取 BTC 持仓上市公司列表（免费端点，无需 API Key）
curl -s "https://api.coingecko.com/api/v3/companies/public_treasury/bitcoin" \
  -H "Accept: application/json" | python3 -c "
import sys, json
data = json.load(sys.stdin)
Confidence
90% confidence
Finding
The skill instructs the agent to fetch remote content with curl and immediately pipe it into an inline Python interpreter for processing. Although the current snippet only parses JSON, this pattern increases risk because remote data is fed directly into an execution chain, and if later modified or reused with less strict parsing it can become a vehicle for command/script injection or unsafe processing of untrusted content.

External Script Fetching

High
Category
Supply Chain
Content
"

# 抓取 ETH 持仓上市公司列表
curl -s "https://api.coingecko.com/api/v3/companies/public_treasury/ethereum" \
  -H "Accept: application/json" | python3 -c "
import sys, json
data = json.load(sys.stdin)
Confidence
90% confidence
Finding
This repeats the same risky pattern for a second endpoint: untrusted remote data is retrieved via curl and streamed directly into inline Python. In a skill context that may be automatically activated, such shell-based fetch-and-process chains are more dangerous because they encourage execution of network-dependent commands without strong isolation or validation.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# 抓取 BTC 持仓上市公司列表（免费端点，无需 API Key）
curl -s "https://api.coingecko.com/api/v3/companies/public_treasury/bitcoin" \
  -H "Accept: application/json" | python3 -c "
import sys, json
data = json.load(sys.stdin)
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# 抓取 BTC 持仓上市公司列表（免费端点，无需 API Key）
curl -s "https://api.coingecko.com/api/v3/companies/public_treasury/bitcoin" \
  -H "Accept: application/json" | python3 -c "
import sys, json
data = json.load(sys.stdin)
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.