ClawHub
Back to skill

Security audit

Crypto Research

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent crypto research helper that delegates user prompts to CellCog, but users should be careful with sensitive portfolio details and unpinned install commands.

Before installing, verify the CellCog package/source and consider pinning a reviewed version instead of using upgrade-style commands. When using the skill, avoid submitting wallet addresses, exact balances, account identifiers, or full portfolio values unless necessary; use ranges or redacted examples where possible and independently verify research before financial or tax decisions.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:218
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 218–221
Vulnerability Type: Unpinned and mutable third-party dependencies
Risk Level: Medium

text
**Claude Code, Cursor, Codex + 70 more agents:** `npx skills add cellcog/skills --skill cellcog`
**OpenClaw:** `openclaw skills install @cellcog/cellcog`
**CellCog plugin users:** run `/cellcog-setup` (or `/cellcog:cellcog-setup` depending on your tool)
**Manual setup:** `pip install -U cellcog` and set `CELLCOG_API_KEY`. See the **cellcog** skill for SDK reference.

Technical Analysis

The documented installation commands retrieve third-party components without specifying verified versions, immutable commit hashes, or integrity checksums. In particular, pip install -U cellcog requests the newest available package release, while the npx and OpenClaw installation commands similarly identify mutable upstream package sources.

Consequently, the code installed by a future invocation may differ from the content available when this Skill was reviewed. If an upstream repository, package registry account, release pipeline, or transitive dependency is compromised, users following these instructions could install attacker-controlled code. This is a supply-chain weakness; the audited file does not establish that the currently available CellCog package is malicious.

Attack Path

  1. An attacker compromises an upstream package publisher, registry account, source repository, build pipeline, or dependency used by the referenced package.
  2. The attacker publishes a malicious release under the expected package identifier.
  3. A user or agent follows one of the unpinned installation instructions in SKILL.md.
  4. The package manager resolves the mutable identifier to the attacker-controlled release.
  5. Malicious installation hooks or package code execute when the component is installed or subsequently imported.
  6. The payload operates with the privileges and ...[truncated 584 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin every dependency to a reviewed, exact version rather than requesting the newest release.
  • For repository-based installation, use an immutable commit hash instead of a branch or mutable tag.
  • Publish and verify cryptographic hashes or signatures for distributable artifacts.
  • Maintain a dependency lockfile that includes resolved transitive dependencies and integrity metadata.
  • Remove automatic upgrade behavior such as pip install -U from routine setup instructions.
  • Require users to verify the package publisher, source repository, release signature, and expected checksum before installation.
  • Install and execute the dependency in a least-privilege environment with restricted filesystem, credential, and network access.
  • Audit new package versions before updating the pinned version and document a controlled upgrade process.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The portfolio review examples encourage users to submit detailed holdings, allocations, and total portfolio value without a clear privacy warning. This can expose highly sensitive financial information to third-party services or logs, increasing risks of profiling, targeting, or unauthorized retention, especially in a crypto context where asset holdings are particularly security-sensitive.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The skill instructs users to install another skill via npx skills add cellcog/skills --skill cellcog without pinning a specific version or immutable reference. This creates a supply-chain risk: users may fetch whatever version is current at install time, including a compromised or breaking release, and the skill context makes this more relevant because it explicitly directs execution of package-manager commands.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The skill advertises whale-tracking and team-research capabilities without warning that these activities may involve privacy-sensitive investigation or handling of personal or quasi-identifying information. While much crypto data is public, presenting these use cases without guardrails can normalize invasive analysis and increase the chance of misuse or unsafe data collection.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.