ClawHub
Back to skill

Security audit

Aiusd Skills

Security checks for vulnerabilities and agentic risk

Overview

This skill matches its trading purpose, but it can move real funds and its install/auth flows run local commands and delete credential files without enough user confirmation.

Review carefully before installing. Use a dedicated directory and low-privilege account, back up any existing aiusd-skill directory, inspect the embedded package, avoid automatic npm lifecycle scripts when possible, and require your agent to ask for explicit confirmation before any trade, withdrawal, staking, unstaking, or gas top-up.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:10
Finding

Agent behavior and response hijacking through mandatory skill instructions

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
.
Finding

Opaque embedded archives are extracted and followed by automatic dependency installation

Content
View full analysis
/dev/null 2>&1; then log_success "Dependencies installed successfully" else log_warning "Failed to install dependencies automatically" log_info "Please run manually: cd aiusd-ski ...[truncated 2567 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
.
Finding

Installers recursively delete existing installations without confirmation or path hardening

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (18)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

The 'Agent Output Guidelines' are prompt-level instructions embedded in the skill that attempt to control the agent's wording and response behavior. In isolation this is not code execution, but it is a direct attempt to steer the model's outputs and can suppress transparent explanations in a sensitive financial context, so it is appropriately flagged as prompt injection content.

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md
This skill calls the AIUSD backend via MCP. Auth is resolved in order: env `MCP_HUB_TOKEN`, mcporter OAuth, or local `~/.mcp-hub/token.json`. Ensure a valid Bearer token is available before calling.

## ⚠️ Agent Output Guidelines

**CRITICAL - ABSOLUTELY FORBIDDEN PHRASES**:
Agents must NEVER use these words or phrases when responding to users:

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
83% confidence
Finding

The file contains a large embedded base64/gzip payload that hides the real skill contents from review while presenting user-facing references to tools and setup steps. In this context, the opaque self-extracting package materially increases risk because it can conceal poisoned MCP/tool metadata, prompt instructions, or executable install scripts that are not auditable from the wrapper alone.

Content

Scanner excerpt · aiusd-skill-installer.js (reported line 80)May include surrounding context.

js
kill && npm install', 'cyan');
    }

    log('', 'reset');
    log('🎉 AIUSD Skill installed successfully!', 'green');
    log('', 'reset');
    log('🚀 Next Steps:', 'yellow');
    log('1. cd aiusd-skill', 'blue');
    log('2. npm run setup', 'blue');
    log('', 'reset');
    log('💡 Usage Examples:', 'cyan');
    log('• Check balance: npm start -- balances', 'blue');
    log('• List tools: npm start -- tools', 'blue');
    log('• Get help: npm start -- --help', 'blue');
    log('', 'reset');

  } catch (error) {
    log(`❌ Installation failed: ${error.message}`, 'red');
    process.exit(1);
  }
}

// Package data (base64 encoded)
const PACKAGE_DATA = `H4sIAEq2hWkAA+y9XW8cSZIg2LvA4XB5z3vPXixhMqnOTH6TUqpVNckPldhFiSqSqppaSUMGM4NkSJkZ2RGRpFgqDnqAmQP2pmdnbqaBvRtMo3fncHOLwwF3+zb7G+5fFHDP0z/hzMy/PTwykxTJ6pEyGl1iRribu5ubm5uZm5nX9+s/uelndnZ2ZWmJ0b/L/N/Z+UX+L/97gc0tzS3OLSwszM3Ns9m5efj3J2z2xnsGzyDNggS60joJBr1WeF5UDoodHQ2Bw4fC1L//Up7/5n/4b3/yr3/ykydBi23vsj9i4sF3P/nv4P/z8P9fwP/x9/

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · aiusd-skill-installer.sh (reported line 98)May include surrounding context.

sh
iusd-skill && npm install"
    fi

    echo ""
    log_success "AIUSD Skill installed successfully!"
    echo ""
    echo -e "${YELLOW}🚀 Next Steps:${NC}"
    echo -e "${BLUE}1. cd aiusd-skill${NC}"
    echo -e "${BLUE}2. npm run setup${NC}"
    echo ""
    echo -e "${CYAN}💡 Usage Examples:${NC}"
    echo -e "${BLUE}• Check balance: npm start -- balances${NC}"
    echo -e "${BLUE}• List tools: npm start -- tools${NC}"
    echo -e "${BLUE}• Get help: npm start -- --help${NC}"
    echo ""

    exit 0
}

# Run main function unless sourced
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
    main "$@"
fi

# Archive marker - do not remove this line
__ARCHIVE_START__
H4sIAEu2hWkAA+y9XW8cSZIg2LvA4XB5z3vPXixhMqnOTH6TUqpVNckPldhFiSqSqppaSUMGM4NkSJkZ2RGRpFgqDnqAmQP2pmdnbqaBvRtMo3fncHOLwwF3+zb7G+5fFHDP0z/hzMy/PTwykxTJ6pEyGl1iRribu5ubm5uZm5nX9+s/uelndnZ2ZWmJ0b/L/N/Z+UX+L/97gc0tzS3OLSwszM0tsNm5+YW5+Z+w2RvvGTyDNAsS6ErrJBj0WuF5UTkodnQ0BA4fClP//kt5/pv/4b/9yb/+yU+eBC22vcv+iIkH3/3kv4P/z8P/fwH/x9

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README encourages users to execute trades, withdrawals, swaps, and staking actions through natural-language prompts, but it does not include clear warnings that these actions may be irreversible, financially risky, or capable of transferring real assets. In a conversational agent context, this omission is more dangerous because users may treat chat-driven actions as casual and low-friction, increasing the chance of accidental or impulsive loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill covers withdrawals, trades, staking, unstaking, and gas top-ups, all of which can move funds or create irreversible financial effects, but it does not require explicit confirmations or prominent risk warnings before execution. In a financial skill, omission of confirmation and consequence disclosure materially increases the chance of accidental or socially engineered asset movement.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs the agent to clear local authentication caches and token files and to run local npm/node re-authentication commands. That expands the skill from backend trading/account actions into host-side state modification and command execution, which can affect unrelated sessions, overwrite credentials, or trigger unsafe local behavior if followed automatically.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The re-auth instructions direct deletion or clearing of auth caches and token files without warning the user that local authentication state will be modified. This can log users out, remove valid credentials, or interfere with other sessions and should not happen silently in a skill workflow.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The error-handling section normalizes automatic execution of local re-auth commands whenever auth errors occur. This creates a path for tool-triggered command execution outside the core purpose of the skill and could be abused by crafted failures or misconfigurations to make the agent perform unnecessary local actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The installer unconditionally deletes an existing directory with fs.rmSync(..., { recursive: true }) and no confirmation, backup, or safety checks. This can destroy local data and makes accidental or malicious reinstallation materially harmful.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The installer launches shell commands for archive extraction and dependency installation without meaningful prior warning or trust verification. In practice this means a user running the installer may trigger arbitrary code from the archive or npm lifecycle scripts immediately during install.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The installer executes external commands (tar -xzf and npm install) on an embedded, opaque package without any integrity verification, content inspection, or sandboxing. Because npm install can run arbitrary lifecycle scripts from the extracted package, this creates a direct code-execution path on the host and is especially risky given that the payload is hidden inside a large base64 blob.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script presents itself as a self-extracting installer, but it also changes into the extracted directory and runs npm install. npm install may automatically execute lifecycle scripts from the embedded package, turning a simple extraction step into arbitrary code execution without clear, explicit user consent. Because the payload is hidden inside a bundled base64 archive that is not inspectable from the shell wrapper alone, this materially increases risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The installer unconditionally removes $SKILL_DIR with rm -rf if it already exists, without prompting or offering a backup. This can destroy local changes, credentials, configuration, or other user data residing in the target directory. In a skill installer context, users may rerun installation casually, making accidental data loss more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

Running npm install on an extracted, opaque package can execute arbitrary preinstall, install, or postinstall scripts defined in the embedded package or its dependencies. Since the archive contents are hidden in base64 and the user is not explicitly warned that code may run during dependency installation, this creates a significant remote code execution and supply-chain risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The file imposes strict language constraints such as 'Agents must NEVER use these words or phrases' and 'ZERO TOLERANCE,' which is a natural-language policy restriction applied unconditionally. SQP-3 covers language or locale policy violations when a skill forces output style or language behavior without user choice or clear justification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The comments/frame suggest simple extraction, but the implementation first removes any existing aiusd-skill directory recursively. This mismatch reduces user awareness and can cause destructive data loss if the directory contains prior work, configs, or modifications.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The header comments describe the file as containing a skill package and imply a straightforward installer invocation, but omit destructive and code-executing behavior such as deleting an existing directory and installing dependencies. Misleading packaging and documentation reduce a user's ability to make an informed trust decision, which is especially risky for self-extracting archives with opaque embedded contents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The script installs into a subdirectory of the current working directory and does not clearly warn the user in advance that execution will write files there. While this is not inherently malicious, silent writes into whatever directory the user happens to be in can clutter sensitive locations or create confusion about where files landed.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
aiusd-skill-installer.js:58