ClawHub
Back to skill

Security audit

trade-with-aiusd

Security checks for vulnerabilities and agentic risk

Overview

This crypto trading skill is review-worthy because it can affect real funds and its setup and reauthentication flows are broader and less transparent than they should be.

Install only after reviewing the decoded package and accepting that this skill can place trades, stake, withdraw, read local auth tokens, and delete shared authentication state during re-login. Avoid running the self-extracting installers on a machine with unrelated MCP credentials unless you have backups and are comfortable with npm lifecycle scripts executing under your user account.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:10
Finding

Mandatory Agent Response and Authentication-Flow Hijacking

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:175
Finding

Destructive Deletion of Shared Authentication Directories

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
aiusd-skill-installer.js:45
Finding

Opaque Embedded JavaScript Package Is Extracted and Its npm Lifecycle Scripts Are Executed

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
aiusd-skill-installer.sh:61
Finding

Opaque Embedded Shell Package Is Extracted and Its npm Lifecycle Scripts Are Executed

Content
View full analysis
/dev/null 2>&1; then log_success "Dependencies installed successfully" else log_warning "Failed to install dependencies automatically" log_info "Please run manually: cd aiusd-skill && npm install" fi ``` The archive follows the marker at lines 110-112: ```bash # Archive marker - do not remove this line __ARCHIVE_START__ H4sIAGrei2kAA... ``` ### Technical Analysis The shell installer obtains its payload from an opaque Base64 archive appended to the same script. It streams that data directly into `tar`, without first verifying a signature, digest, archive contents, or extraction paths. It then invokes `npm install`, permitting dependency lifecycle scripts to execute. This creates two linked supply-chain risks: the reviewed shell logic does not reveal the effective package implementation, and npm may resolve or execute third-party components at installation time. The command also suppresses npm output, reducing the user's ability to notice unexpected package sources, warnings, or lifecycle actions. As with the JavaScript installer, the visible code does not prove that the embedded payload is malicious. The confirmed weakness is that the installation design automatically trusts and executes content that cannot be meaningfully audited from the ordinary project files. ### Attack Path 1. A user runs `bash aiusd-skill-installer.sh`. 2. The script locates the archive marker wit ...[truncated 936 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Findings (22)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The skill is presented as a trading tool, but the noted behavior acts as a distribution/installer wrapper that removes directories and installs external code. In this context, concealment of installer behavior inside a finance-related skill is especially risky because it mixes wallet/auth access with host modification and dependency execution.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill is presented as a trading tool, but the noted behavior acts as a distribution/installer wrapper that removes directories and installs external code. In this context, concealment of installer behavior inside a finance-related skill is especially risky because it mixes wallet/auth access with host modification and dependency execution.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
94% confidence
Finding

The 'Agent Output Guidelines' attempt to control the agent's wording and suppress certain disclosures unrelated to safe tool operation. This is a prompt-level manipulation pattern: it can interfere with transparent reporting, steer the model away from accurate descriptions, and is especially suspicious because it overrides normal user-facing communication in a financial context.

Content

Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.

md
This skill calls the AIUSD backend via MCP. Auth is resolved in order: env `MCP_HUB_TOKEN`, mcporter OAuth, or local `~/.mcp-hub/token.json`. Ensure a valid Bearer token is available before calling. **Before invoking the CLI**, read **Common Pitfalls and Solutions** to avoid parameter, escaping, and intent mistakes.

## ⚠️ Agent Output Guidelines

**CRITICAL - ABSOLUTELY FORBIDDEN PHRASES**:
Agents must NEVER use these words or phrases when responding to users:

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

7. Auth file locations and full reset

  • Auth state may live in: ~/.mcporter/credentials.json, ~/.mcp-hub/token.json, or env MCP_HUB_TOKEN.
  • Full auth reset:
    bash
    rm -rf ~/.mcporter ~/.mcp-hub

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
94% confidence
Finding

The combined rm -rf ~/.mcporter ~/.mcp-hub command performs broad deletion of cached auth material across multiple directories. In the context of a crypto trading skill, destructive credential-store manipulation is particularly dangerous because it can disrupt authenticated workflows, trigger account confusion, and normalize unsafe shell execution.

Content

Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.

  • Auth state may live in: ~/.mcporter/credentials.json, ~/.mcp-hub/token.json, or env MCP_HUB_TOKEN.
  • Full auth reset:
    bash
    rm -rf ~/.mcporter ~/.mcp-hub
unset MCP_HUB_TOKEN
npm run reauth

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
94% confidence
Finding

The combined rm -rf ~/.mcporter ~/.mcp-hub command performs broad deletion of cached auth material across multiple directories. In the context of a crypto trading skill, destructive credential-store manipulation is particularly dangerous because it can disrupt authenticated workflows, trigger account confusion, and normalize unsafe shell execution.

Content

Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.

  • Auth state may live in: ~/.mcporter/credentials.json, ~/.mcp-hub/token.json, or env MCP_HUB_TOKEN.
  • Full auth reset:
    bash
    rm -rf ~/.mcporter ~/.mcp-hub
unset MCP_HUB_TOKEN
npm run reauth

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
94% confidence
Finding

The combined rm -rf ~/.mcporter ~/.mcp-hub command performs broad deletion of cached auth material across multiple directories. In the context of a crypto trading skill, destructive credential-store manipulation is particularly dangerous because it can disrupt authenticated workflows, trigger account confusion, and normalize unsafe shell execution.

Content

Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.

  • Auth state may live in: ~/.mcporter/credentials.json, ~/.mcp-hub/token.json, or env MCP_HUB_TOKEN.
  • Full auth reset:
    bash
    rm -rf ~/.mcporter ~/.mcp-hub
unset MCP_HUB_TOKEN
npm run reauth

Credential Access

High
Category
Privilege Escalation
Confidence
80% confidence
Finding

The documentation suggests running a Node command to probe for the existence of a credential file in the user's home directory. While it only checks existence, it normalizes agent-driven inspection of credential storage, which is sensitive behavior in a skill that handles financial accounts and authentication.

Content

Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.

curl -I https://mcp.alpha.dev/api/mcp-hub/mcp

Check mcporter credential file exists

node -e "console.log(require('fs').existsSync(require('os').homedir() + '/.mcporter/credentials.json'))"

text

### 11. Common error codes (install/runtime)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · aiusd-skill-installer.js (reported line 80)May include surrounding context.

js
kill && npm install', 'cyan');
    }

    log('', 'reset');
    log('🎉 AIUSD Skill installed successfully!', 'green');
    log('', 'reset');
    log('🚀 Next Steps:', 'yellow');
    log('1. cd aiusd-skill', 'blue');
    log('2. npm run setup', 'blue');
    log('', 'reset');
    log('💡 Usage Examples:', 'cyan');
    log('• Check balance: npm start -- balances', 'blue');
    log('• List tools: npm start -- tools', 'blue');
    log('• Get help: npm start -- --help', 'blue');
    log('', 'reset');

  } catch (error) {
    log(`❌ Installation failed: ${error.message}`, 'red');
    process.exit(1);
  }
}

// Package data (base64 encoded)
const PACKAGE_DATA = `H4sIAGHei2kAA+y923IjSZYg1rtmsjVBz9KzFytnALCAIADeMpGXaiaT2cVuJplNMqu2lJlDBoEgEZUAAhMRIJOVybEesx6ZraZnZzTTZqsdm7beHZlm12Qyk/Zt91Wmf9B7/cDOJ+hc3D3c4wKQWSS7pxLRXUkywv24+/Hjx48fPxfnwPnRTT+NRmN1eVnQzxX+2Wgt8U/+fVE0l5tLrdXl1eZSUzSarcXWyo9E48Z7Bs84it0QutLpueNhxzsvKgfFjo8nwOGhCP3zn8rz3/wP/+JH//xHP3rmdsTOnviXQj747kf/LfzXgv/+GP7Dv/

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

The self-extracting installer embeds a large opaque archive, and the YARA match indicates possible metadata/tool poisoning inside the hidden payload. Even though the visible shell wrapper does not show the poisoned content directly, bundling concealed skill/tool metadata in an unreviewable archive increases the chance that downstream agents or users will ingest adversarial instructions or manipulated tool schemas.

Content

Scanner excerpt · aiusd-skill-installer.sh (reported line 98)May include surrounding context.

sh
iusd-skill && npm install"
    fi

    echo ""
    log_success "AIUSD Skill installed successfully!"
    echo ""
    echo -e "${YELLOW}🚀 Next Steps:${NC}"
    echo -e "${BLUE}1. cd aiusd-skill${NC}"
    echo -e "${BLUE}2. npm run setup${NC}"
    echo ""
    echo -e "${CYAN}💡 Usage Examples:${NC}"
    echo -e "${BLUE}• Check balance: npm start -- balances${NC}"
    echo -e "${BLUE}• List tools: npm start -- tools${NC}"
    echo -e "${BLUE}• Get help: npm start -- --help${NC}"
    echo ""

    exit 0
}

# Run main function unless sourced
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
    main "$@"
fi

# Archive marker - do not remove this line
__ARCHIVE_START__
H4sIAGrei2kAA+y923IjSZYg1rtmsjVBz9KzFytnALCAIADeMpGXaiaT2cVuJplNMqu2lJlDBoEgEZUAAhMRIJOVybEesx6ZraZnZzTTZqsdm7beHZlm12Qyk/Zt91Wmf9B7/cDOJ+hc3D3c4wKQWSS7pxLRXUkywv24+/Hjx48fPxfnwPnRTT+NRmN1eVnQzxX+2Wgt8U/+fVE0l5tLrdXl1eZySzSarcXFxo9E48Z7Bs84it0QutLpueNhxzsvKgfFjo8nwOGhCP3zn8rz3/wP/+JH//xHP3rmdsTOnviXQj747kf/LfzXgv/+GP7Dv/

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README promotes natural-language trading, withdrawals, staking, and automatic installation/authentication with no prominent warnings about irreversible transactions, custody risks, authentication scope, or the need for explicit confirmation before account-impacting actions. In a financial skill, this omission is dangerous because users may trigger real trades or withdrawals through casual chat interactions, increasing the risk of unauthorized, accidental, or socially engineered asset loss.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
83% confidence
Finding

The skill recommends running npx mcporter without pinning a version, which allows whatever package version is current at execution time to be fetched and run. In an installation/auth flow for a financial skill, this increases supply-chain risk because a compromised or breaking upstream release could execute unexpected code on the host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documented 'full auth reset' instructs deletion of credential directories and unsetting auth tokens without clearly warning that this destroys cached authentication state. Even if intended for troubleshooting, these are destructive actions affecting access and potentially other workflows using the same credential stores.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill instructs agents to automatically run reauthentication flows that clear cached auth state upon certain errors, without first warning the user or obtaining confirmation. Automatic credential/cache clearing is risky because transient errors could trigger destructive auth resets and disrupt other sessions or accounts.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Importing child_process gives the installer the ability to execute arbitrary shell commands, and that capability is used later for tar extraction and dependency installation. For a trading/account-management skill, unnecessary subprocess capability increases attack surface because any compromise of the embedded package or command construction can lead to local code execution on the host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The installer deletes the existing aiusd-skill directory recursively with no prompt, backup, or path safety guard beyond a fixed join to the current working directory. This can destroy local data, custom configuration, logs, or credentials stored under that directory, creating avoidable integrity and availability risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The installer silently writes an embedded archive to disk and extracts it via a shell command without up-front disclosure of its filesystem and process activity. That opacity matters more here because the skill claims to manage cryptocurrency trading/accounts, so hidden installation actions reduce user ability to assess whether the package could introduce code that later handles sensitive financial secrets.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The installer performs archive extraction and dependency installation by invoking system tooling, which expands its behavior beyond simple skill delivery and executes unpinned third-party code during npm install. In a cryptocurrency trading skill, this is especially risky because the installed package may later gain access to API keys, wallets, or account credentials, and the embedded archive is opaque to reviewers in this file.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script forcefully removes an existing aiusd-skill directory with rm -rf before extraction. Unprompted destructive filesystem behavior is risky because it can delete local data, prior configs, logs, or manually added files, and the user gets no chance to verify the target before deletion.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Deleting an existing installation directory without confirmation is an unsafe installer practice that can cause irreversible local data loss. In a trading/account-management context, that directory may contain API credentials, account settings, history, or audit artifacts, increasing the seriousness of accidental deletion.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The installer runs npm install without warning that package lifecycle scripts may execute code during installation. This is especially dangerous here because the installer unpacks an opaque archived payload and immediately installs it, preventing informed review before code execution.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The installer automatically executes npm install, which can run arbitrary lifecycle scripts from the bundled package and all transitive dependencies. Because the payload is hidden inside a self-extracting base64 archive and not inspectable from this file alone, this creates a meaningful remote-code-execution and persistence risk on the host running the installer.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
aiusd-skill-installer.js:58