ClawHub
Back to skill

Security audit

trade-with-aiusd

Security checks for vulnerabilities and agentic risk

Overview

This AIUSD trading skill appears purpose-aligned, but it gives an agent high-impact financial and credential authority with under-scoped installation, re-authentication, and disclosure controls.

Review before installing. This skill can initiate trades, staking, withdrawals, and gas-related actions through authenticated AIUSD tooling. Only use it if you are comfortable with the installer running npm scripts, replacing a local aiusd-skill directory, reading local auth/session token locations, and potentially clearing local authentication caches during reauth. For financial actions, require explicit transaction previews and confirmations outside the skill's wording rules.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:10
Finding

Agent Response and Security Disclosure Hijacking

Content
View full analysis
Remediation
View remediation

T04 · Embedded Malicious Code

Error
Location
aiusd-skill-installer.js:53
Finding

Opaque Embedded Package Is Extracted and Installed Without Integrity Validation

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
aiusd-skill-installer.js:62
Finding

Automatic Dependency Installation Can Execute Unreviewed Lifecycle Scripts

Content
View full analysis
/dev/null 2>&1; then log_success "Dependencies installed successfully" else log_warning "Failed to install dependencies automatically" log_info "Please run manually: cd aiusd-skill && npm install" fi ``` ### Technical Analysis The installers invoke `npm install` automatically after extracting an opaque package. The reviewed project directory does not expose the extracted `package.json`, a pinned lockfile, dependency versions, integrity metadata, or lifecycle scripts. By default, `npm install` may execute package lifecycle hooks such as `preinstall`, `install`, and `postinstall`. These hooks run arbitrary commands with the permissions of the installer user. Dependency resolution may also contact external registries and retrieve code that was not part of the audited files. Because the dependency manifest is hidden in the embedded archive, reviewers cannot establish whether dependencies are pinned, whether unusual registries or URL-based dependencies are used, or whether installation scripts are present. ### Attack Path 1. The user launches the installer. 2. The hidden package manifest is extracted. 3. The installer runs `npm install` without firs ...[truncated 1149 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
aiusd-skill-installer.js:45
Finding

Installer Recursively Deletes Existing Installation Without Confirmation or Backup

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
91% confidence
Finding

The skill contains strong prompt-level instructions that attempt to control agent output and operational sequencing, including mandatory phrasing bans and required command execution order. In a security-sensitive trading skill, this kind of embedded prompt control is dangerous because it can override normal safe assistant behavior, suppress transparent communication, and steer the agent into actions based on untrusted skill content.

Content

Scanner excerpt · SKILL.md (reported line 10)May include surrounding context.

md
This skill calls the AIUSD backend via MCP. Auth is resolved in order: env `MCP_HUB_TOKEN`, mcporter OAuth, or local `~/.mcp-hub/token.json`. Ensure a valid Bearer token is available before calling.

## ⚠️ Agent Output Guidelines

**CRITICAL - ABSOLUTELY FORBIDDEN PHRASES**:
Agents must NEVER use these words or phrases when responding to users:

Missing User Warnings

High
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill directs the agent to auto-run reauthentication steps, including clearing auth caches and local token files, when certain errors occur. This is dangerous because it can trigger destructive credential/session changes without user confirmation, potentially logging users out, switching accounts, or interfering with valid local auth state.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
87% confidence
Finding

The file embeds a large opaque base64/gzip payload and then extracts and installs it without any integrity verification or transparency about its contents. In an agent skill context, that is dangerous because the real behavior is hidden from review, may include poisoned tool metadata or arbitrary package scripts, and is followed by npm install and a later npm run setup that can execute attacker-controlled code.

Content

Scanner excerpt · aiusd-skill-installer.js (reported line 80)May include surrounding context.

js
kill && npm install', 'cyan');
    }

    log('', 'reset');
    log('🎉 AIUSD Skill installed successfully!', 'green');
    log('', 'reset');
    log('🚀 Next Steps:', 'yellow');
    log('1. cd aiusd-skill', 'blue');
    log('2. npm run setup', 'blue');
    log('', 'reset');
    log('💡 Usage Examples:', 'cyan');
    log('• Check balance: npm start -- balances', 'blue');
    log('• List tools: npm start -- tools', 'blue');
    log('• Get help: npm start -- --help', 'blue');
    log('', 'reset');

  } catch (error) {
    log(`❌ Installation failed: ${error.message}`, 'red');
    process.exit(1);
  }
}

// Package data (base64 encoded)
const PACKAGE_DATA = `H4sIAEq2hWkAA+y9XW8cSZIg2LvA4XB5z3vPXixhMqnOTH6TUqpVNckPldhFiSqSqppaSUMGM4NkSJkZ2RGRpFgqDnqAmQP2pmdnbqaBvRtMo3fncHOLwwF3+zb7G+5fFHDP0z/hzMy/PTwykxTJ6pEyGl1iRribu5ubm5uZm5nX9+s/uelndnZ2ZWmJ0b/L/N/Z+UX+L/97gc0tzS3OLSwszM3Ns9m5efj3J2z2xnsGzyDNggS60joJBr1WeF5UDoodHQ2Bw4fC1L//Up7/5n/4b3/yr3/ykydBi23vsj9i4sF3P/nv4P/z8P9fwP/x9/

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The installer runs npm install on an extracted, opaque package, which executes package lifecycle scripts such as preinstall, install, and postinstall. Because the embedded archive is not inspectable in this review and comes from a self-extracting blob, this grants arbitrary code execution to package-defined scripts during installation.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · aiusd-skill-installer.sh (reported line 98)May include surrounding context.

sh
iusd-skill && npm install"
    fi

    echo ""
    log_success "AIUSD Skill installed successfully!"
    echo ""
    echo -e "${YELLOW}🚀 Next Steps:${NC}"
    echo -e "${BLUE}1. cd aiusd-skill${NC}"
    echo -e "${BLUE}2. npm run setup${NC}"
    echo ""
    echo -e "${CYAN}💡 Usage Examples:${NC}"
    echo -e "${BLUE}• Check balance: npm start -- balances${NC}"
    echo -e "${BLUE}• List tools: npm start -- tools${NC}"
    echo -e "${BLUE}• Get help: npm start -- --help${NC}"
    echo ""

    exit 0
}

# Run main function unless sourced
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
    main "$@"
fi

# Archive marker - do not remove this line
__ARCHIVE_START__
H4sIAEu2hWkAA+y9XW8cSZIg2LvA4XB5z3vPXixhMqnOTH6TUqpVNckPldhFiSqSqppaSUMGM4NkSJkZ2RGRpFgqDnqAmQP2pmdnbqaBvRtMo3fncHOLwwF3+zb7G+5fFHDP0z/hzMy/PTwykxTJ6pEyGl1iRribu5ubm5uZm5nX9+s/uelndnZ2ZWmJ0b/L/N/Z+UX+L/97gc0tzS3OLSwszM0tsNm5+YW5+Z+w2RvvGTyDNAsS6ErrJBj0WuF5UTkodnQ0BA4fClP//kt5/pv/4b/9yb/+yU+eBC22vcv+iIkH3/3kv4P/z8P/fwH/x9

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README encourages users to execute trades, withdrawals, staking, and gas top-ups through natural-language chat, but it does not clearly warn that these actions can be financially risky, irreversible, or prone to misunderstanding in conversational interfaces. In a skill that enables movement of funds, omission of explicit risk and confirmation guidance can lead to accidental asset loss or unauthorized-looking transactions caused by user confusion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The file imposes absolute natural-language restrictions such as banning specific ordinary words and requiring tightly constrained authentication phrasing. This is a natural-language response policy that is not presented as user opt-in or clearly justified by a documented compliance or locale requirement.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill gives tightly constrained authentication response text, then elsewhere instructs the agent to automatically run reauthentication commands and report progress. That contradiction can cause unsafe or inconsistent handling of auth failures, increasing the chance the agent performs account-affecting actions without clear user awareness or gives misleading status messages.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The top-level documentation states this file contains the complete AIUSD trading skill package and implies installation is as simple as running the script. In practice, the installer also runs npm install via execSync and tells the user to run npm run setup, so the packaged file is not self-sufficient in the way the comment claims.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The installer unconditionally deletes any existing aiusd-skill directory with fs.rmSync(..., { recursive: true }) and does not prompt, back up, or verify ownership of the target contents. This can destroy local data or overwrite a prior installation unexpectedly, which is especially risky for a script intended to be run directly by users.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script deletes an existing aiusd-skill directory with rm -rf and no confirmation or safety guard. If run from an unexpected directory or by a user who has modified that folder, this can destroy local data irreversibly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This finding is effectively the same underlying issue as the previous one: the installer removes the target directory without any confirmation prompt. Silent destructive behavior in installer code is dangerous because users may lose configuration, code, or other files placed in that directory.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
aiusd-skill-installer.js:58