ClawHub
Back to skill

Security audit

Gecko Terminal API

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed read-only GeckoTerminal market-data CLI, with expected outbound API calls and no evidence of credential handling, trading, persistence, or hidden behavior.

Before installing, understand that using this skill sends your market-data searches, token addresses, pool addresses, and query parameters to GeckoTerminal. It does not need wallet access or API keys and should not be used as a trading or transaction tool.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill uses a local Node CLI and performs outbound network access, but the manifest does not declare an explicit tool/permission scope. That weakens least-privilege enforcement and makes it harder for a host to constrain what the skill is allowed to do, especially if the underlying script behavior changes later. In this context the documented behavior is read-only market-data access, which reduces severity, but the undeclared capability gap is still a real security issue.

External Transmission

Medium
Category
Data Exfiltration
Content
#!/usr/bin/env node

const BASE_URL = new URL("https://api.geckoterminal.com/api/v2/");
const BASE_ORIGIN = BASE_URL.origin;
const BASE_PATH_PREFIX = BASE_URL.pathname.endsWith("/")
  ? BASE_URL.pathname
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
#!/usr/bin/env node

const BASE_URL = new URL("https://api.geckoterminal.com/api/v2/");
const BASE_ORIGIN = BASE_URL.origin;
const BASE_PATH_PREFIX = BASE_URL.pathname.endsWith("/")
  ? BASE_URL.pathname
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Vague Triggers

Low
Confidence
88% confidence
Finding
The markdown suggests using the phrase "gecko trending pools + new pools + top pools" in a daily brief, but it does not define whether this is an exact trigger, a loose example, or what nearby phrasing should not activate the skill. Because this file is markdown and user-invocable is enabled, the lack of specificity could cause unintended invocation from similar everyday briefing text.

Static analysis

Detected: suspicious.env_credential_access, suspicious.secret_argv_exposure

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/geckoterminal-cli.mjs:8

Instructions pass high-value credentials through process argv.

Critical
Code
suspicious.secret_argv_exposure
Location
SKILL.md:43