ClawHub
Back to skill

Security audit

Nano (XNO)

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed Nano wallet skill for real XNO operations, so it is not risk-free but its sensitive behavior is mostly scoped and explained.

Install this only if you want an assistant to operate configured Nano/XNO wallets. Before any send, independently verify the wallet, full destination address, amount, and spending limit; avoid the unpinned `npx -y xno-skills mcp` fallback and never paste private keys or mnemonics into the assistant.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (14)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
89% confidence
Finding

This anti-refusal language pressures the agent to interpret ambiguous phrases like 'Send me Nano' as a request involving assistant-controlled wallets and explicitly instructs it not to refuse. In a financial skill with real fund movement capability, that reduces the model's safety margin against social engineering, coercive prompt phrasing, or unclear authority around receiving and later moving funds.

Content

Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.

md
> **Never say** "I don't have a wallet", "I can't receive funds", or "the skill only operates wallets you control" when `wallet_list` exposes configured wallets.

**Disambiguation**: "Send me Nano" means send to an **assistant-controlled wallet**, unless the user names another recipient. Do not reinterpret it as a request to send to a hypothetical personal wallet, and do not refuse on that basis.

Before any wallet operation, call `wallet_list`. If the user says they want to send Nano to the assistant, list the wallets, identify a suitable receiving wallet/address, and present the full address (never abbreviated). Do not initiate a receive until the user asks to claim funds or a payment workflow requires it.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger phrase 'transaction analysis' is highly ambiguous and may match requests about bank transfers, blockchain activity on other networks, or unrelated fraud review tasks. Because this skill is empowered to operate assistant-controlled cryptocurrency wallets, misrouting a generic transaction query into this skill increases the chance of disclosing wallet details or steering the conversation into unintended crypto operations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The phrase 'largest transaction' is not scoped to Nano and could capture many unrelated analytics or support prompts. In a wallet-capable skill, such overbroad routing is risky because it can cause the agent to invoke Nano-specific tools or present wallet-related guidance in the wrong context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

These triggers are broad enough to activate the Nano wallet skill for generic finance, payment, balance, refund, wallet, QR, or transaction-related requests that may have nothing to do with Nano. In this skill's context, accidental activation is more dangerous because the skill can expose assistant-controlled wallet addresses, inspect balances, and potentially prepare fund movement workflows in response to ambiguous prompts.

Content

No source excerpt is available for this finding.

Shadow Command Trigger

Medium
Category
Trigger Abuse
Confidence
80% confidence
Finding

The trigger 'open account' can collide with generic platform commands or unrelated user intents about opening an account, causing the Nano skill to activate unexpectedly. In this context, unexpected activation is security-relevant because the skill can enumerate configured wallets and initiate sensitive financial workflows if the conversation continues down that path.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 510)May include surrounding context.

md
**Note**: `verify` accepts both `nano_`/`xrb_` addresses and raw 32-byte hex public keys.

> Do not prompt the user to export their mnemonic to get a private key. Never accept, repeat, or emit a private key value — only use the placeholder pattern above.

Full options: [sign](references/sign.md), [verify](references/verify.md)

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

The fallback command 'npx -y xno-skills mcp' invokes a package without a pinned version, allowing resolution to whatever version is current at execution time. In an MCP context, that is especially risky because the fetched package becomes a long-running server integrated into the agent workflow and may gain access to wallet operations, transaction data, and other sensitive capabilities if a malicious or compromised release is published.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation exposes a direct cryptocurrency send command but does not warn that blockchain transfers are irreversible, that destination addresses must be carefully verified, or that mistaken sends can permanently lose funds. In this skill context, the risk is elevated because the assistant is explicitly empowered to operate configured wallets, so missing safety language can contribute to unsafe or unintended fund transfers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This reference documents a command that signs and submits a prepared Nano block but does not warn that doing so can authorize irreversible on-chain actions such as sending funds or changing account state. In a wallet skill, omission of a clear confirmation/safety warning increases the risk that a user or agent invokes the command on untrusted block data and unintentionally broadcasts a harmful transaction.

Content

No source excerpt is available for this finding.

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/troubleshooting.md (reported line 35)May include surrounding context.

md
**Diagnose in order, stopping at the first resolution:**

| Step | Check                                                                   | Action                                                                                                                                                            |
| ---- | ----------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 1    | Was this the very first `send`/`receive` on a fresh MCP or CLI process? | Allow for first-use warmup. Retry the operation once.                                                                                                             |
| 2    | Did the error say "Timed out after 10000ms"?                            | That is the local WASM per-backend timeout. It means WASM itself failed or is unavailable. Check Node.js version (`node --version`) — WASM PoW requires Node 16+. |

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · references/troubleshooting.md (reported line 37)May include surrounding context.

md
| Step | Check                                                                   | Action                                                                                                                                                            |
| ---- | ----------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 1    | Was this the very first `send`/`receive` on a fresh MCP or CLI process? | Allow for first-use warmup. Retry the operation once.                                                                                                             |
| 2    | Did the error say "Timed out after 10000ms"?                            | That is the local WASM per-backend timeout. It means WASM itself failed or is unavailable. Check Node.js version (`node --version`) — WASM PoW requires Node 16+. |
| 3    | Is the system under heavy CPU load?                                     | WASM PoW is CPU-bound. A send block requires ~8× more work than receive. Wait for load to drop, then retry.                                                       |

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

L130 says to always pin the CLI version as @4.5.2 for bunx/pnpm dlx/npx, but the surrounding commands and supply-chain policy consistently require xno-skills@5.0.0 (for example L108-L113, L121-L127, L164). This is an active contradiction in the skill's own execution guidance and could cause the agent to use a different version than the one the document otherwise mandates.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown file documents a command that displays diagnostics and system information, which can include environment, platform, or configuration details relevant to privacy or security. The description does not include any user warning about reviewing or safely handling that output, especially when using JSON output or rerunning tuning.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.