ClawHub
Back to skill

Security audit

Token Scan

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed token-risk lookup wrapper that calls CertiK for a user-provided contract and does not show hidden, persistent, destructive, or credential-seeking behavior.

Install only if you are comfortable sending the chain name and contract address you ask about to CertiK's public token-scan API. Treat the results as third-party security signals that the agent summarizes, not as guaranteed financial advice or a complete audit.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

The code generally aligns with the broad theme of token risk scanning by querying a token-scan API using chain and contract address. However, the declared description says it will return a structured summary with specific fields like score, tax, holder concentration, and LP lock status. This implementation simply proxies the external API response as raw JSON and handles transport/errors; it does not transform the response into the promised structured summary or explicitly provide those named outputs. Also, while the description specifies supported chains, the code accepts any chain string without validation. There is no evidence of unrelated or dangerous undeclared capabilities beyond the network call needed for the scan.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill is supposed to provide a normalized security summary, but it returns upstream API data verbatim. In a security-analysis context, this can cause downstream agents or users to misinterpret incomplete or differently shaped data, omit key risk fields, or trust unvalidated external content as if it were the promised structured assessment.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill declares network-capable behavior and execution of a local Python script, but it does not define an explicit tool scope such as permissions or allowed-tools. In agent environments, missing scope declarations can lead to broader-than-expected network access or make the runtime rely on permissive defaults, increasing the chance of unintended outbound requests.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The module docstring explicitly describes the behavior as merely calling an API and returning raw JSON. That contradicts the stated skill intent in the manifest, which promises a structured summary including score, tax, holder concentration, and LP lock status rather than a passthrough response.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The request header hard-codes "Accept-Language": "en-US,en;q=0.9", which imposes a specific language/locale preference. The file does not offer a user opt-in or explain why an English locale is required, so this is a natural-language locale policy issue.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The argument parser description frames the tool as a direct API wrapper. That is narrower and materially different from the manifest's claim that the skill performs token risk analysis and returns a structured summary with interpreted security attributes.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.