ClawHub
Back to skill

Security audit

AIresearchOS

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but it needs Review because it can use API credentials and spend crypto funds through under-scoped commands and mutable dependencies.

Review before installing. Use a dedicated low-balance wallet and a limited API key, avoid setting a custom base URL unless you fully trust that endpoint, do not submit secrets or sensitive business data in research prompts, and prefer pinned/reviewed dependencies before enabling x402 payments.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/check-status.mjs:29
Finding

Bearer Credential Disclosure Through an Unrestricted Custom API Endpoint

Content
View full analysis
","mode":"","reportLength":"standard","skipClarifyingQuestions":false}' ``` ### Technical Analysis The status checker accepts an arbitrary `--base-url`, constructs request URLs from it, and attaches `AIRESEARCHOS_API_KEY` whenever `--api-path` equals `/api/v1`. It does not enforce HTTPS, validate the hostname, reject embedded URL credentials, or restrict the destination to A ...[truncated 1676 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:78
Finding

Shell Command Injection Through Unescaped Research Queries and Clarification Answers

Content
View full analysis
","mode":"","reportLength":"standard","skipClarifyingQuestions":false}' ``` x402 research submission: ```bash node {baseDir}/scripts/x402-request.mjs \ --url "${AIRESEARCHOS_BASE_URL:-https://airesearchos.com}/api/x402/research/" \ --method POST \ --body '{"query":"","reportLength":"standard"}' \ --max-payment ``` Clarification submission: ```bash curl -s -X POST "${AIRESEARCHOS_BASE_URL:-https://airesearchos.com}/api/v1/research//clarify" \ -H "Authorization: Bearer $AIRESEARCHOS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"answers":["","",""]}' ``` ### Technical Analysis The Skill tells the Agent to substitute user-controlled research queries and clarification answers into single-quoted shell arguments. A single quote in user input terminates the shell string. Subsequent characters can then be interpreted as shell syntax rather than request data. The documented input checks only constrain type, length, and allowed enumerations. They do not provide shell escaping or JSON serialization. JSON escaping by itself would also be insufficient if the resulting data were still interpolated unsafely into a shell command. Because these commands run in the Agent environment, successful command injection executes with the same operating-system privileges and environment access as the Agent. The x402 command is especially sensitive because the process environment may contain `AIRESEARCHOS_WALLET_KEY ...[truncated 1384 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/x402-request.mjs:29
Finding

Insufficient Validation of x402 Payment Destination and Spending Bounds

Content
View full analysis
maxPaymentUsd) { process.stderr.write(JSON.stringify({ error: 'payment_exceeds_max', required: req.amount, required_usdc: requiredUsd, max: String(Math.round(maxPaymentUsd * 1_000_000)), max_usdc: maxPaymentUsd, }) + '\n') process.exit(1) } // Step 4: Sign payment process.stderr.write(JSON.stringify({ step: 'signing_payment' }) + '\n') let encodedPayment try { const { x402Version, payload: innerPayload } = await evmScheme.createPaymentPayload(version, req) const paymentPayload = { x402Version, accepted: req, payload: innerPayload, } encodedPayment = encodePaymentSignatureHeader(paymentPayload) } catch (err) { ``` The signed payment is returned to the same unrestricted URL: ```javascript const paidResponse = await fetch(url, paidOpts) ``` ### Technical Analysis The helper accepts any URL and trusts the first payment option supplied by a remote HTTP 402 response. Before requesting a wallet signature, it does not independently enforce: - HTTPS transport. - The expected AIresearchOS origin. - Base mainnet or chain ID 8453. - The canonical USDC asset contract. - An approved facilitator or payment recip ...[truncated 2187 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/package.json:7
Finding

Mutable Third-Party Dependencies Installed Without an Integrity-Pinned Lockfile

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README explicitly instructs users to place a blockchain wallet private key in local skill configuration, but it does not clearly warn that this value is highly sensitive and can enable irreversible theft of on-chain funds if the host, config file, backups, or repo are exposed. In the context of a payment-enabled skill using USDC on Base, normalizing private-key placement in config increases the chance of unsafe storage, accidental commit, or overbroad file access by other local tools.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill performs privileged actions involving environment secrets and outbound network requests, but it does not declare an explicit tool scope or allowed-tools policy. That increases the blast radius because a host agent may grant broader execution capability than necessary, making accidental misuse or abuse of API keys and network access more likely.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

This command sends user-supplied research queries to an external service together with authenticated API access. While external transmission is expected for this skill's purpose, it is still a real data-exfiltration surface because sensitive prompts or business information may be transmitted off-platform to a third party.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

Submit Research (API Key)

bash
curl -s -X POST "${AIRESEARCHOS_BASE_URL:-https://airesearchos.com}/api/v1/research" \
  -H "Authorization: Bearer $AIRESEARCHOS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query":"<USER_QUERY>","mode":"<MODE>","reportLength":"standard","skipClarifyingQuestions":false}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

md
### After Submission: Schedule Background Check via Cron

**CRITICAL: Do NOT poll inline. Do NOT loop. Do NOT run poll-research.mjs. Do NOT run repeated curl commands. Use the `cron` tool.**

After the POST request returns with the research ID, do TWO things:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The script loads a raw EVM private key from an environment variable and uses it to sign payment payloads for server-provided 402 payment requirements, but provides no strong safety controls or warning about the signing and spending implications. In this payment-enabled skill, that increases risk of misuse if a user points the script at an untrusted endpoint, because the tool can be induced to sign payment data with valuable credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script sends an arbitrary caller-supplied request body to any caller-supplied URL via fetch, with no destination allowlist, confirmation step, or warning that sensitive research data may be disclosed to a third party. In this skill context, the helper is explicitly designed to submit research jobs and may handle proprietary prompts, API outputs, or user data, so silent exfiltration risk is real even if the behavior is intended.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The setup guide states that on first use the agent will run npm install, which executes package installation logic and modifies the local filesystem by creating node_modules and downloading code. Although this behavior is disclosed in the x402 dependency section, the warning is not especially prominent and users may not appreciate that enabling the skill can trigger code retrieval and execution-adjacent package lifecycle activity from the network in a local skill directory.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The dependency uses a caret range (^2.3.0), which allows future non-breaking releases to be installed automatically. This can introduce supply-chain risk if a newly published upstream version is compromised, malicious, or unexpectedly changes behavior, and the risk is somewhat heightened here because the package set includes payment and blockchain-related libraries.

Content

Scanner excerpt · scripts/package.json (reported line 8)May include surrounding context.

json
"type": "module",
  "description": "Helper scripts for the AIresearchOS OpenClaw skill",
  "dependencies": {
    "@x402/core": "^2.3.0",
    "@x402/evm": "^2.3.0",
    "viem": "^2.45.2"
  }

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The dependency uses a caret range (^2.3.0), allowing automatic resolution to newer minor/patch versions. That creates a real but low-severity supply-chain exposure, especially in a skill that handles x402 payment flows where dependency compromise could affect transaction logic or credential handling.

Content

Scanner excerpt · scripts/package.json (reported line 9)May include surrounding context.

json
"description": "Helper scripts for the AIresearchOS OpenClaw skill",
  "dependencies": {
    "@x402/core": "^2.3.0",
    "@x402/evm": "^2.3.0",
    "viem": "^2.45.2"
  }
}

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

Using ^2.45.2 permits unreviewed future releases within the same major version to be installed, which weakens build reproducibility and increases exposure to upstream compromise. In this context, the library is part of a blockchain/payment-oriented helper script set, so unexpected dependency changes may have security-sensitive effects even if the base issue remains low severity.

Content

Scanner excerpt · scripts/package.json (reported line 10)May include surrounding context.

json
"dependencies": {
    "@x402/core": "^2.3.0",
    "@x402/evm": "^2.3.0",
    "viem": "^2.45.2"
  }
}

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/x402-request.mjs:41