ClawHub
Back to skill

Security audit

Cournot

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent and disclosed, but its optional wallet setup path uses an unpinned remote install command in a payment context.

Install only if you are comfortable with Cournot sending event queries to its external API and with the optional paid wallet flow. Do not run the wallet setup command unless you explicitly want that wallet integration, and prefer a pinned, reviewed wallet install source before using real funds.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
references/payment.md:88
Finding

Unpinned Wallet Skill Installation Creates a Supply-Chain Execution Risk

Content
View full analysis

Vulnerability Details

File Location: references/payment.md:88-92
Vulnerability Type: Unpinned executable dependency and mutable remote Skill installation
Risk Level: High

Vulnerable Code

markdown
Install it only after an explicit request:

```sh
npx skills add binance/binance-skills-hub/skills/binance-web3/binance-agentic-wallet

After wallet setup, rerun prepare for the preserved Cournot request so the client obtains fresh payment terms.

text

### Technical Analysis

The documented installation command invokes the `skills` package through `npx` without specifying an exact package version and installs wallet-related code from a mutable repository path without pinning an immutable commit or verifying integrity.

Consequently, the code executed or installed at runtime may differ from the code reviewed during this audit. User confirmation controls whether installation occurs, but it does not establish the authenticity or integrity of the retrieved components. A compromised package release, package registry account, repository, branch, or upstream maintainer account could substitute malicious code.

This operation is particularly sensitive because the installed component is intended to participate in wallet setup and payment signing. Fetching mutable executable content exceeds the minimum privileges required merely to query Cournot, although it is only reached through the optional paid-wallet setup workflow.

### Attack Path

1. An attacker compromises the unpinned `skills` npm package, its publication account, the referenced repository, or another mutable component in the installation chain.
2. The attacker publishes or substitutes a malicious package or wallet Skill while retaining the expected package and repository identifiers.
3. A user explicitly requests wallet installation and confirms the setup operation.
4. The agent runs the documented unversioned `npx skills add ...` command.
5. The
...[truncated 1022 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the skills CLI to a reviewed exact version rather than allowing npx to resolve the current release, for example by using an exact version with no semver range.
  2. Pin the Binance wallet Skill to an immutable audited commit digest or signed release tag instead of a mutable repository path.
  3. Verify a publisher-provided cryptographic checksum or signature before installation.
  4. Disable implicit package download behavior where possible. Preinstall the reviewed CLI from a locked dependency manifest and lockfile.
  5. Execute installation in a restricted environment with minimal filesystem and network access, separate from wallet credentials and unrelated user data.
  6. Require a second review whenever the pinned CLI version, wallet Skill revision, checksum, or installation source changes.
  7. Preserve the existing explicit setup and payment confirmations, but do not treat confirmation as a substitute for dependency integrity verification.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md
2. Send probability requests only through `scripts/cournot-client.mjs`, which returns either the result or a sanitized payment preview. Only for a payment previ

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

This file implements x402-style payment parsing, wallet compatibility selection, envelope normalization, and payment header construction, which is materially unrelated to a Cournot event-probability query skill. In this skill context, the mismatch is dangerous because it introduces covert payment-processing behavior that could be used to solicit or prepare cryptocurrency payments under the guise of a probability tool.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The code enumerates wallet support, recommends specific crypto-wallet setup, validates payment envelopes, and builds payment headers for blockchain-based settlement. For a skill whose declared purpose is only querying event probabilities, these capabilities are unjustified and increase the risk of unauthorized monetization, phishing for wallet connection, or routing users into cryptocurrency payment flows they did not request.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/payment.md (reported line 51)May include surrounding context.

md
- `state=approval_pending`: show the approval transaction hash. After it confirms, prepare a fresh payment; display and confirm any changed terms before executing again.
- A command error consumes an intent once wallet authorization has begun. Prepare again rather than reusing it.

Never execute without confirmation, silently switch an option, pay for a different resource, or make a second paid attempt.

## Wallet unavailable or blocked

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file mandates a Chinese-only closing instruction in a specific wallet state without checking the user's language preference. While not a direct code-execution flaw, hardcoded language requirements can mislead users, reduce comprehension of payment/security prompts, and increase the chance of unsafe consent in multilingual contexts.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/payment.md (reported line 81)May include surrounding context.

md
1. Show the exact wallet, network, and setup action; warn that creating or importing a signer can control real assets.
2. Ask for a separate explicit setup confirmation immediately before running any setup command. A prior request to use Cournot, choose a payment route, or pay is not this confirmation.
3. After confirmation, follow the selected wallet or SDK's official setup flow. It may generate a wallet or accept an existing key only through its secure, non-echoing credential prompt. Never ask the user to paste a private key, seed phrase, session token, or wallet credential into chat, and never pass one through a command argument, environment variable, or captured tool output. If secure hidden input is unavailable, provide the official local setup command for the user to run and stop.
4. Report only the public wallet address, selected network, supported asset, and next funding step. Do not expose credentials or raw wallet output.

Once the user chooses a wallet, preserve that selection throughout installation, sign-in, connection checks, and funding. Do not show the generic wallet chooser or ask them to select the same wallet again. Complete the selected wallet's official setup before rerunning `prepare`. If setup is blocked, report that wallet's exact sanitized blocker and offer retry, explicit switch, or stop.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The skill instructs installation via npx skills add ... without pinning a specific version of the skills package or toolchain. This creates a supply-chain risk because a future or compromised package version could change behavior or execute unintended code during installation, especially in a wallet/payment-related skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Line L10 instructs the skill to render timestamps using the English month name, which is a natural-language locale constraint. The file does not offer any user choice or opt-in for language/locale, and no region-specific justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file instructs the agent to introduce a section as External data basis: in English or 外部数据依据： in Chinese, but does not state that this depends on the user's preference or explicit opt-in. This is a natural-language locale constraint that can violate policy when a skill imposes language behavior without offering choice.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The replay guard enforces exact-body matching for a 'paid replay', which again signals hidden paid-access semantics inconsistent with the documented probability-query function. While this helper alone is not the most severe issue, in context it supports an undisclosed billing/payment workflow and can help normalize deceptive charging logic inside a non-payment skill.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/cournot-client.mjs:290