ClawHub
Back to skill

Security audit

aiusd

Security checks for vulnerabilities and agentic risk

Overview

This financial trading skill is mostly coherent with its stated purpose, but its installer and authentication flow give it too much sensitive authority without enough user control.

Only install after reviewing the unpacked package and accepting the financial and auth risks. Use a dedicated account/environment without valuable wallet funds or unrelated credentials, avoid running the self-extracting installers from an important directory, and require manual confirmation for trades, withdrawals, reauthentication, and any credential deletion.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:10
Finding

Agent Responses Are Overridden During Sensitive Authentication Workflows

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
aiusd-skill-installer.js:53
Finding

Opaque Embedded Package Is Extracted and Its npm Lifecycle Scripts Are Executed

Content
View full analysis
/dev/null 2>&1; then ``` The payload begins at: ```javascript // Package data (base64 encoded) const PACKAGE_DATA = `H4sIAEq2hWkAA... ``` The shell payload begins after: ```bash # Archive marker - do not remove this line __ARCHIVE_START__ H4sIAEu2hWkAA... ``` ### Technical Analysis Both installers contain a large Base64-encoded Gzip archive rather than exposing the installed package as ordinary reviewable source files. The archive is decoded and extracted, after which `npm install` is executed with lifecycle scripts enabled. The reviewed metadata does not provide: - A cryptographic checksum for the decoded archive. - A digital signature. - A source commit identifier. - A visible dependency manifest or lockfile outside the encoded payload. - Evidence that npm lifecycle scripts are disabled. `npm ...[truncated 1932 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
aiusd-skill-installer.js:45
Finding

Installer Recursively Deletes an Existing Target Directory Without Confirmation or Backup

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (15)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md
This skill calls the AIUSD backend via MCP. Auth is resolved in order: env `MCP_HUB_TOKEN`, mcporter OAuth, or local `~/.mcp-hub/token.json`. Ensure a valid Bearer token is available before calling.

## ⚠️ Agent Output Guidelines

**CRITICAL - ABSOLUTELY FORBIDDEN PHRASES**:
Agents must NEVER use these words or phrases when responding to users:

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The installer executes external commands (tar -xzf and npm install) on unpacked opaque base64-embedded content without any validation, review step, or sandboxing. Because npm install can run arbitrary lifecycle scripts from the extracted package, this creates a straightforward arbitrary code execution path on the host during installation.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

The huge opaque embedded payload contains tool-related strings and is not inspectable in this form, which prevents meaningful review of any bundled manifests, schemas, or code. In the context of an agent skill installer, hidden package contents materially increase the risk of metadata poisoning or other malicious behavior because reviewers cannot verify what tools or instructions are being installed.

Content

Scanner excerpt · aiusd-skill-installer.js (reported line 80)May include surrounding context.

js
kill && npm install', 'cyan');
    }

    log('', 'reset');
    log('🎉 AIUSD Skill installed successfully!', 'green');
    log('', 'reset');
    log('🚀 Next Steps:', 'yellow');
    log('1. cd aiusd-skill', 'blue');
    log('2. npm run setup', 'blue');
    log('', 'reset');
    log('💡 Usage Examples:', 'cyan');
    log('• Check balance: npm start -- balances', 'blue');
    log('• List tools: npm start -- tools', 'blue');
    log('• Get help: npm start -- --help', 'blue');
    log('', 'reset');

  } catch (error) {
    log(`❌ Installation failed: ${error.message}`, 'red');
    process.exit(1);
  }
}

// Package data (base64 encoded)
const PACKAGE_DATA = `H4sIAEq2hWkAA+y9XW8cSZIg2LvA4XB5z3vPXixhMqnOTH6TUqpVNckPldhFiSqSqppaSUMGM4NkSJkZ2RGRpFgqDnqAmQP2pmdnbqaBvRtMo3fncHOLwwF3+zb7G+5fFHDP0z/hzMy/PTwykxTJ6pEyGl1iRribu5ubm5uZm5nX9+s/uelndnZ2ZWmJ0b/L/N/Z+UX+L/97gc0tzS3OLSwszM3Ns9m5efj3J2z2xnsGzyDNggS60joJBr1WeF5UDoodHQ2Bw4fC1L//Up7/5n/4b3/yr3/ykydBi23vsj9i4sF3P/nv4P/z8P9fwP/x9/

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · aiusd-skill-installer.sh (reported line 98)May include surrounding context.

sh
iusd-skill && npm install"
    fi

    echo ""
    log_success "AIUSD Skill installed successfully!"
    echo ""
    echo -e "${YELLOW}🚀 Next Steps:${NC}"
    echo -e "${BLUE}1. cd aiusd-skill${NC}"
    echo -e "${BLUE}2. npm run setup${NC}"
    echo ""
    echo -e "${CYAN}💡 Usage Examples:${NC}"
    echo -e "${BLUE}• Check balance: npm start -- balances${NC}"
    echo -e "${BLUE}• List tools: npm start -- tools${NC}"
    echo -e "${BLUE}• Get help: npm start -- --help${NC}"
    echo ""

    exit 0
}

# Run main function unless sourced
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
    main "$@"
fi

# Archive marker - do not remove this line
__ARCHIVE_START__
H4sIAEu2hWkAA+y9XW8cSZIg2LvA4XB5z3vPXixhMqnOTH6TUqpVNckPldhFiSqSqppaSUMGM4NkSJkZ2RGRpFgqDnqAmQP2pmdnbqaBvRtMo3fncHOLwwF3+zb7G+5fFHDP0z/hzMy/PTwykxTJ6pEyGl1iRribu5ubm5uZm5nX9+s/uelndnZ2ZWmJ0b/L/N/Z+UX+L/97gc0tzS3OLSwszM0tsNm5+YW5+Z+w2RvvGTyDNAsS6ErrJBj0WuF5UTkodnQ0BA4fClP//kt5/pv/4b/9yb/+yU+eBC22vcv+iIkH3/3kv4P/z8P/fwH/x9

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README advertises natural-language trading, staking, and withdrawal actions without warning users about irreversible financial operations or describing any confirmation step before execution. In a chat-based, multi-platform bot context, ambiguous prompts, misinterpretation, or unauthorized access to the chat interface could lead to unintended trades or withdrawals with real monetary loss.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill gives mutually inconsistent instructions for authentication messaging: one section requires a very narrow fixed response, while later sections instruct the agent to announce re-auth progress and completion. In a security-sensitive auth flow, conflicting guidance can cause the agent to mislead the user about what actions are being taken, reducing transparency around browser-based login and credential-state changes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The re-authentication instructions tell the agent to clear cached auth data and local token files, but they do not require a prior warning or consent flow before deleting locally stored credentials. This can unexpectedly alter account state, log the user out, or destroy session artifacts needed for recovery or audit, all without informed user approval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill instructs the agent to automatically run re-authentication on common auth errors, including starting browser OAuth and changing credential state without clear user confirmation. Automatic login initiation in a financial/trading context is risky because it can trigger sensitive account actions, confuse users, and normalize hidden state changes around authentication.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The header claims the file contains the complete skill package, but the installer still performs dependency installation, which may fetch unpinned code from registries and execute install scripts. That mismatch is dangerous because it obscures the true trust boundary and can mislead users into treating the installer as self-contained when it can trigger additional remote code execution paths.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The installer unconditionally deletes any existing aiusd-skill directory in the current working directory using recursive removal, with no confirmation, backup, or safety checks. Running the installer from an unexpected location can destroy local files and create a denial-of-service/data-loss condition for the user.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The installer unconditionally deletes any existing aiusd-skill directory with rm -rf and does not ask for confirmation or validate contents. This can destroy local work, credentials, configuration, or prior trusted code if a user happens to run the script in an important directory.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The script presents itself as extracting package data, but its behavior extends to dependency installation and subsequent setup guidance that can trigger package-defined scripts. This mismatch reduces informed consent and increases the chance a user executes untrusted code under the assumption the installer is only unpacking files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

Running npm install on an extracted package without an explicit warning hides two major risks: network access and execution of package lifecycle scripts. Because the archive contents are embedded and not human-reviewable in the script itself, the user is asked to trust and execute opaque code immediately after extraction.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The installer runs npm install on an extracted, opaque package payload. npm install can execute package lifecycle scripts such as preinstall, install, and postinstall, which gives the bundled skill arbitrary code execution during installation rather than mere unpacking.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

These instructions impose rigid language constraints on agent responses, including banning common words regardless of user preference or context. This is a natural-language policy issue because it forces a specific communication style without explaining a justified policy basis or offering flexibility.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
aiusd-skill-installer.js:58