ClawHub
Back to skill

Security audit

Web3 Investor

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed remote DeFi research skill that does not appear to trade, use wallet keys, or persist data locally, but users should treat submitted investment preferences as shared with Antalpha.

Before installing, be comfortable sending DeFi queries, risk preferences, product IDs, session IDs, and optional feedback to Antalpha's remote MCP server. Do not submit wallet seed phrases, private keys, personally identifying details, or full private portfolio records, and avoid running the optional unpinned npx MCP examples unless you pin and verify the packages.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (10)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README explicitly states that natural-language queries and investment analysis are handled by a remote MCP server, but it does not clearly warn users that their prompts and related metadata are transmitted off-device. In a finance-oriented skill, users may disclose sensitive portfolio details, risk appetite, or investment intent, so the lack of a prominent privacy disclosure can lead to uninformed sharing of sensitive financial information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill advertises session-aware memory and stored intent but does not disclose retention scope, duration, or whether the stored preferences are linked to identifiers on the remote service. Because the skill concerns DeFi investing, stored intent may reveal financial preferences, risk tolerance, and behavioral signals that are privacy-sensitive even if not traditionally classified as credentials.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill declares MCP/network capabilities via metadata but does not define an explicit tool scope such as permissions or allowed-tools. That creates an authorization ambiguity where an agent or platform may permit broader remote access than the user expects, especially since all queries and investment intent are sent to a third-party server.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

This markdown file includes the example user trigger "Find me good yields," which is a broad natural-language phrase without clear scope constraints. Because the skill is framed around natural-language requests and multi-round activation, this kind of generic phrasing could collide with ordinary conversation and lead to unintended invocation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The documentation recommends executing an npm package via npx without pinning an exact version, which can cause users to fetch and run whatever version is current at execution time. If the package is later compromised, typo-squatted, or updated with malicious code, readers may execute attacker-controlled code on their systems.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

Using npx etherscan-mcp without a pinned version instructs users to download and execute the latest published package at runtime. In a Web3 context, where tools may access API keys and sensitive blockchain workflows, a compromised upstream package could steal credentials or manipulate outputs.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The unpinned npx defillama-mcp command creates a supply-chain risk because execution depends on whatever package version is available at the time the command is run. Even though no API key is required, arbitrary code execution on the operator's machine remains possible if the package or publishing account is compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

DUNE_API_KEY=xxx npx dune-mcp combines an unpinned executable package with a live credential in the same command, increasing the risk that a malicious package version could immediately exfiltrate the API key. The skill context makes this somewhat more dangerous because Web3 analytics tooling often handles sensitive data, financial decisions, and privileged integrations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This code formats errors with Chinese text, and the surrounding response-formatting functions consistently emit Chinese-only labels and prompts. For a general-purpose client, forcing a specific language without user opt-in matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

The changelog explicitly states the skill was rewritten to be "English" and the surrounding documentation consistently presents the interaction model as English-only, without offering a user language choice. That can create a language-policy issue if the skill forces a specific language or locale by default rather than allowing user preference.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.