ClawHub
Back to skill

Security audit

Fluora Balance

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: reads a configured Fluora wallet address and checks its USDC balance on Base Mainnet, with some dependency and scoping cautions.

Before installing, understand that running the skill will read your local Fluora wallet metadata file and send the wallet address in a read-only balance query to the Base public RPC endpoint. Keep the lockfile in use, update the vulnerable transitive dependency when available, and prefer invoking it only for Fluora/Base USDC balance checks.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Known Vulnerable Dependency: ws==8.17.1 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High
Category
Supply Chain
Confidence
94% confidence
Finding

The lockfile pins ws to 8.17.1, and the finding identifies published advisories for memory disclosure and memory-exhaustion denial of service in that version. Because this dependency is pulled in transitively by ethers, any skill runtime path that enables WebSocket-based RPC connections could expose the agent process to remote crashes or memory leakage when interacting with a malicious or compromised endpoint.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger description is broad enough to activate on generic phrases like 'wallet balance' or 'how much money they have,' which could cause the skill to run in unintended contexts. In an agent environment, overly broad invocation can lead to unnecessary access to local wallet metadata and external RPC calls, increasing the chance of privacy leakage or misrouting user requests.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/check_balance.js (reported line 22)May include surrounding context.

js
async function getUsdcBalance(walletAddress) {
  try {
    // Create provider
    const provider = new ethers.JsonRpcProvider(BASE_RPC);

    // Create contract instance

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
89% confidence
Finding

The dependency version for ethers is specified with a caret range (^6.13.0), which allows newer minor and patch releases to be installed. This can introduce supply-chain risk because future upstream releases may contain vulnerabilities, malicious code, or breaking changes that alter runtime behavior without an explicit review. In this skill, the package is used for blockchain interaction, so unexpected dependency changes could affect wallet/balance logic, though the scope here appears limited.

Content

Scanner excerpt · scripts/package.json (reported line 7)May include surrounding context.

json
"description": "Scripts for checking Fluora wallet balance on Base Mainnet",
  "private": true,
  "dependencies": {
    "ethers": "^6.13.0"
  }
}

Static analysis

No suspicious patterns detected.