ClawHub
Back to skill

Security audit

zoo-security-scanner

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent paid hosted scanner, but it tells agents to automatically spend USDC and send scan targets to an outside API without enough user-control safeguards.

Review before installing. Use this only for targets you own or are authorized to test, avoid submitting confidential internal hosts unless you accept disclosure to the provider, and do not allow unattended wallet signing. Require confirmation for every payment and verify the USDC amount, Base network, recipient address, and scan target before approving.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

other

Warning
Location
SKILL.md:26
Finding

Unbounded Automated Cryptocurrency Payment

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 26-27; related payment claims appear at lines 3, 10, and 61
Vulnerability Type: Unconfirmed automated cryptocurrency transaction
Risk Level: Medium

Vulnerable Snippet

markdown
2. Server returns `402 Payment Required` with x402 payment instructions
3. Agent pays in USDC on Base network

The documented destination is:

markdown
Payments: `0x697D7c4B60cA15C03479189c63463a30e230F2AD` (Base)

Technical Analysis

The Skill instructs the Agent to act on payment instructions dynamically returned by https://api.zootechnologies.com/scan and pay USDC automatically. It does not require explicit user approval for each transaction or define controls for validating the token, network, amount, recipient, chain identifier, or payment request expiration.

Although a wallet is documented at line 61, the instructions do not require the Agent to compare the recipient in the remote x402 response with that address. No transaction-level spending limit, cumulative budget, replay protection, or rejection policy for mismatched payment terms is specified.

Consequently, a compromised, impersonated, or malicious API response could present altered payment terms that an implementing Agent may accept without informed user authorization.

Attack Path

  1. A user asks the Agent to scan a target through the Skill.
  2. The Agent sends the target to the external /scan endpoint.
  3. The endpoint, or an attacker controlling its responses, returns HTTP 402 with manipulated x402 payment instructions.
  4. The manipulated terms specify an excessive amount, an unauthorized recipient, or otherwise unexpected transaction parameters.
  5. Following the Skill's instruction that the “Agent pays,” the Agent signs or submits the transaction without explicit transaction-specific confirmation.
  6. USDC is irreversibly transferred according to the attacker-controlled terms.

...[truncated 611 chars]

Remediation
View remediation

Remediation Suggestions

  1. Require explicit user confirmation before every payment, displaying:
    • Exact USDC amount
    • Recipient address
    • Base network and chain identifier
    • Scan target and scan type
    • Estimated network fee
  2. Validate the payment recipient against a trusted allowlist. If the wallet at line 61 is authoritative, reject any response naming another recipient.
  3. Enforce strict per-transaction and cumulative spending limits independent of remotely supplied payment instructions.
  4. Validate token contract, amount, recipient, network, nonce, expiration, and request-to-scan binding before signing.
  5. Reject expired, replayed, malformed, unexpectedly priced, or recipient-mismatched payment requests.
  6. Use a dedicated wallet with a minimal balance and no unrelated token approvals.
  7. Pin and authenticate the expected API origin, and handle redirects without forwarding payment authorization to untrusted hosts.
  8. Document pricing as informational only and require confirmation whenever remote pricing differs from the expected amount.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation states that the agent automatically pays in USDC after receiving a 402 response, but it does not prominently warn users that invoking the skill can spend funds. In autonomous or semi-autonomous agent environments, this creates a real risk of unauthorized or unexpected financial loss through accidental or repeated scans.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill advertises an extremely broad activation scope ('any URL, skill, or infrastructure') without constraints on authorized targets, safe-use boundaries, or exclusions. In an agent setting, this can cause over-invocation and facilitate scanning of sensitive or third-party systems without clear user confirmation or scope validation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The quick-start example sends a target URL to a third-party API without any notice that target data, metadata, or potentially sensitive infrastructure identifiers will be disclosed externally. This can lead users or agents to unintentionally share internal hosts, private services, or confidential assessment targets with an outside service.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The skill explicitly transmits user-supplied target information to an external domain via a POST request. While external transmission is expected for a hosted scanning service, it is still security-relevant because it can disclose sensitive target information and may trigger scans against systems outside the user's control.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

Scan a URL

bash
curl -X POST https://api.zootechnologies.com/scan \
  -H "Content-Type: application/json" \
  -d '{"target": "https://example.com", "scan_type": "full"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The skill explicitly transmits user-supplied target information to an external domain via a POST request. While external transmission is expected for a hosted scanning service, it is still security-relevant because it can disclose sensitive target information and may trigger scans against systems outside the user's control.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

Scan a URL

bash
curl -X POST https://api.zootechnologies.com/scan \
  -H "Content-Type: application/json" \
  -d '{"target": "https://example.com", "scan_type": "full"}'