ClawHub
Back to skill

Security audit

aaveclaw

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent testnet Aave tool, but it asks agents to use a raw wallet private key and perform blockchain transactions without enough safety boundaries or warnings.

Install only with a dedicated Base Sepolia test wallet that holds no mainnet or valuable assets, protect any key file with strict local permissions, verify the network and contract addresses before use, and understand that deposit, borrow, repay, withdraw, faucet, wrapping, and approval commands sign real testnet transactions. Review or change the unlimited approval behavior before adapting this skill for production networks.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/lib/aave.js:28
Finding

Persistent Unlimited ERC-20 Allowances Granted to the Aave Pool

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/lib/config.js:17
Finding

Wallet Private Key Loaded from Unencrypted Files Without Permission Validation

Content
View full analysis
Remediation
View remediation
~/.x402-config.json chmod 600 ~/.x402-config.json ``` 5. Add `x402-config.json` and equivalent secret files to `.gitignore`. 6. Avoid printing, logging, or including the key in error telemetry. 7. Recommend a dedicated testnet-only wallet and explicitly warn users not to reuse keys that control production assets. 8. If environment-variable support remains available, document its process-inspection and logging risks and prefer short-lived injection from a secret manager. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Known Vulnerable Dependency: ws==8.17.1 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High
Category
Supply Chain
Confidence
97% confidence
Finding

The lockfile pins ws to 8.17.1, and the reported advisories indicate this version is affected by memory disclosure and denial-of-service issues. Even though ws is only a transitive dependency of ethers, shipping a known-vulnerable pinned version is still a real supply-chain risk if the skill opens websocket connections or processes attacker-controlled websocket traffic.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
79% confidence
Finding

The skill documents access to a local wallet configuration file and therefore implies environment/local credential usage, but it does not declare any explicit tool scope or permissions boundary. That makes the skill's operational capabilities less transparent and increases the chance an agent uses sensitive local resources without clear authorization controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill states it uses the wallet from ~/.x402-config.json but does not clearly warn that this file contains a private key that grants full control over the wallet. Users may be induced to create or expose highly sensitive credentials without understanding the risk of theft, unintended signing, or loss of funds.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documented commands perform on-chain state changes such as deposit, borrow, repay, and withdraw, but the skill does not prominently warn that these actions submit blockchain transactions and alter the user's lending position. This can lead to unintended borrowing, collateral changes, gas expenditure, or liquidation risk if users or agents treat the commands as informational rather than transactional.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
83% confidence
Finding

The skill instructs users to store a private key in a persistent file under the home directory, creating long-lived sensitive session material on disk. Persistent plaintext secrets increase the blast radius of local compromise, accidental disclosure, backup leakage, or misuse by other tools that can access the same path.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md
## Error Handling

- If private key is missing: direct user to create `~/.x402-config.json` with `{"private_key": "0x..."}`
- If insufficient balance: the scripts report exact balances and what is needed
- If health factor would drop too low after borrow: Aave reverts the transaction automatically
- If faucet fails: the faucet contract may have minting limits or may not be available

Session Persistence

Medium
Category
Rogue Agent
Confidence
86% confidence
Finding

The code explicitly supports loading a blockchain private key from a persistent plaintext file in the user's home directory (~/.x402-config.json). Persisting a signing key unencrypted on disk increases the chance of key theft through local compromise, backup leakage, accidental disclosure, or other tools reading the file, and in this skill that key authorizes on-chain lending and borrowing actions.

Content

Scanner excerpt · scripts/lib/config.js (reported line 41)May include surrounding context.

js
}

  throw new Error(
    'Private key not found. Set X402_PRIVATE_KEY env var or create ~/.x402-config.json with {"private_key": "0x..."}',
  );
}

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
90% confidence
Finding

The dependency uses a caret range (^6.13.0), which allows automatic installation of newer compatible versions instead of a single fixed release. This creates a supply-chain risk: builds may become non-reproducible and a compromised or breaking upstream release could be pulled in without explicit review. In a blockchain-interaction skill, unexpected dependency changes are more sensitive because library behavior directly affects transaction construction and signing flows.

Content

Scanner excerpt · package.json (reported line 7)May include surrounding context.

json
"private": true,
  "type": "module",
  "dependencies": {
    "ethers": "^6.13.0"
  }
}

Static analysis

No suspicious patterns detected.