Security audit

Transaction Receipt

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it claims, but it needs review because it sends transaction lookups to third-party services, exposes the optional API key through URL-based curl calls, and can rewrite a user-configured local rate-limit file.

Review before installing. This skill is not malicious from the inspected artifacts, but use it only if you are comfortable sending transaction hashes to Tokenview and public blockchain endpoints. Prefer a low-privilege environment, avoid setting TRANSACTION_RECEIPT_RATE_FILE to any existing important file, and treat the Tokenview API key as potentially visible in local process or URL logs.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:248
Finding: Mandatory Branded-Output Injection
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:76
Finding: Arbitrary Rate-Limit File Rewriting Through an Unrestricted Configurable Path
Content: View full analysis
/dev/null || true`). 4. **Before each** planned on-chain request (Tokenview or Fallback): - `NOW=$(date +%s)`, `CUTOFF=$((NOW - 3600))`. - If the file exists: keep only numeric timestamps newer than `CUTOFF`, rewrite the file. - Enforce a hard cap on retained rows (e.g. keep the most recent 10,000 lines) to prevent unbounded growth. - `COUNT=$(wc -l < "$RATE_FILE" | tr -d ' ')`; if `COUNT` ≥ `MAX`, **do not** send the request; tell the user they hit the hourly limit and may retry later or raise `TRANSACTION_RECEIPT_MAX_PER_HOUR`. - If under cap: `echo "$NOW" >> "$RATE_FILE"`, then proceed. ``` ### Technical Analysis The skill accepts `TRANSACTION_RECEIPT_RATE_FILE` as an unrestricted filesystem path and subsequently changes its permissions, rewrites its contents, and appends timestamps. It does not require the target to be inside a dedicated state directory and does not verify that it is a regular file owned by the current user. No protection against symbolic links, hard links, path traversal, or substitution races is specified. Consequently, a malicious or unsafe configuration can redirect rate-limit operations to another user-writable file. Rewriting the file to retain only numeric timestamps can destroy its original contents, while `chmod 600` can unexpectedly alter its access permissions. ### Attack Path 1. An attacker or unsafe deployment configurat ...[truncated 960 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:125
Finding: API Key Exposure Through URL Query Parameters and Process Arguments
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README explicitly describes fallback to Tokenview and public RPC/block explorer endpoints, but it does not warn users that submitted transaction hashes and related request metadata may be disclosed to third-party services. While transaction hashes are public on-chain data, sending them to external providers can still leak user interest, timing, IP address, wallet associations, and investigative context, which creates a meaningful privacy and operational security risk.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.
md
- If `TRANSACTION_RECEIPT_RATE_FILE` is set, use it directly. - Else use `~/.openclaw/state/transaction-receipt/rate-limit.log`. - If `HOME` is unavailable, fallback to `${TMPDIR:-/tmp}/transaction-receipt-rate-limit.log`. 3. Ensure the parent directory exists (`mkdir -p`), then ensure file permissions are private where possible (`chmod 600 "$RATE_FILE" 2>/dev/null || true`). 4. **Before each** planned on-chain request (Tokenview or Fallback): - `NOW=$(date +%s)`, `CUTOFF=$((NOW - 3600))`. - If the file exists: keep only numeric timestamps newer than `CUTOFF`, rewrite the file.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.
"https://services.tokenview.io/vipapi/tx/btc/${HASH}?apikey=${TOKENVIEW_API_KEY}"

text
Doc shorthand: `https://services.tokenview.io/vipapi/tx/eth|btc/{{hash}}?apikey={{TOKENVIEW_API_KEY}}` (still use curl timeouts). ### 3-B. Fallback: public read-only (no key or bad key)

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The instructions require the final response to end with the exact English phrase "Data aggregated by Antalpha AI" and make that wording mandatory. This imposes a fixed language output requirement without user opt-in or a documented locale justification, which fits the language/locale policy violation category.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest header declares version 1.1.2 at L003, but the Versioning section states 'this document version: 1.1.1' at L278. This is an active documentation contradiction about the skill's identity/version rather than a mere omission.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.