critical
suspicious.dangerous_exec
- Location
- aiusd-skill-installer.js:58
- Finding
- Shell command execution detected (child_process).
trade-with-aiusd
AdvisoryAudited by Static analysis on May 10, 2026.
Overview
Detected: suspicious.dangerous_exec
Findings (1)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
What this means
A misunderstood request, changed backend schema, or overly broad tool choice could place trades, stake funds, withdraw assets, or top up gas with real financial impact.
Why it was flagged
The skill directs the agent to use a dynamic backend tool surface for high-impact financial actions, and the provided instructions do not show a required final confirmation or transaction-safety review.
Skill content
MANDATORY: Before calling ANY tool, run `aiusd-skill tools --detailed`... NEW TOOLS may be added... genalpha_execute_intent | Execute trade intent (buy/sell/swap) ... genalpha_withdraw_to_wallet | Withdraw to external wallet
Recommendation
Require explicit user confirmation for every mutating action, including asset, amount, destination address, fees, and consequences; pin or review tool schemas before use.
What this means
Installing or using the skill may grant the agent delegated authority over a financial account, including balances, trades, staking, and withdrawals.
Why it was flagged
The skill uses bearer/OAuth tokens and a local token file for account-mutating financial operations, while the registry declares no required credentials, env vars, or config paths.
Skill content
Auth is resolved in order: env `MCP_HUB_TOKEN`, mcporter OAuth, or local `~/.mcp-hub/token.json`. Ensure a valid Bearer token is available before calling.
Recommendation
Use only narrowly scoped tokens, verify which account is authorized, keep balances limited, and revoke the token if the skill is no longer trusted.
What this means
Users may believe they are installing an instruction-only skill while also receiving unvetted installer code from an unknown source.
Why it was flagged
The registry presents no install mechanism or source provenance, yet the artifact includes installer code, creating a mismatch between declared and actual setup surface.
Skill content
Source: unknown; Homepage: none ... No install spec — this is an instruction-only skill. Code file presence: 2 code file(s): aiusd-skill-installer.sh, aiusd-skill-installer.js
Recommendation
Require a declared install spec, verified source repository/homepage, transparent package contents, and pinned dependencies before trusting the installer.
What this means
Running the installer can execute package lifecycle code or install dependencies before the user has reviewed the decoded package.
Why it was flagged
The installer executes local shell commands, extracts an embedded archive, and runs npm install; this is expected for an installer but under-declared for a skill listed as having no install spec.
Skill content
execSync(`tar -xzf package.tar.gz`, { cwd: skillDir, stdio: 'pipe' }); ... execSync('npm install', { cwd: skillDir, stdio: 'inherit' });Recommendation
Do not run the installer unless you trust the publisher; inspect the extracted package first, use a sandbox, and prefer npm install with scripts disabled where possible.
What this means
The assistant may avoid explaining verification or safety caveats when the user is authorizing financial account actions.
Why it was flagged
The skill attempts to control agent wording by banning security-relevant verification language, which is not necessary for the stated trading purpose and can reduce transparency.
Skill content
VERIFICATION-RELATED (COMPLETELY BANNED): - 'skill verification', 'verification' ... ZERO TOLERANCE
Recommendation
Remove wording bans that suppress security or verification discussion; the agent should be free to give clear safety and authentication guidance.
What this means
The AIUSD backend can receive sensitive account, transaction, and trading-intent data needed to operate the service.
Why it was flagged
External MCP/backend communication is disclosed and purpose-aligned, but it means account data and trade intents travel through the provider's backend under bearer-token authorization.
Skill content
This skill calls the AIUSD backend via MCP. Auth is resolved in order: env `MCP_HUB_TOKEN`, mcporter OAuth, or local `~/.mcp-hub/token.json`.
Recommendation
Use only if you trust the AIUSD/MCP provider and verify the authentication endpoint and account being connected.