ClawHub
Back to skill

Security audit

Near Intents

Security checks for vulnerabilities and agentic risk

Overview

This skill is for crypto swaps and is mostly coherent, but its default auto mode can spend from a configured NEAR wallet without a clearly required final user confirmation.

Install only if you are comfortable with an agent-assisted crypto workflow. Prefer manual mode, verify asset, amount, recipient, refund address, quote, deadline, and fees yourself, and do not provide a private key for auto mode unless you use a limited wallet and require explicit approval before every transaction.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

YARA rule 'ransomware_behavior': Ransomware-like patterns (mass encryption, ransom notes) [malware]

Critical
Category
YARA Match
Content
. Swap NEAR → USDC (same chain)
```typescript
await executeIntent({
  assetIn: 'NEAR',
  assetOut: 'USDC',
  amount: '2.0',
});
```

### 4. Get a quote: How much NEAR for 10 USDC on Arbitrum?
```typescript
const quote = await executeIntent({
  assetIn: 'NEAR',
  assetOut: 'arb:USDC',
  amount: '10.0',
  recipient: '0xYourArbAddress',
  mode: 'manual',
  swapType: 'EXACT_OUTPUT',
});
```

### 5. Send BTC to NEAR address
```typescript
const quote = await executeIntent({
  assetIn: 'btc:BTC',
  assetOut: 'NEAR',
  amount: '0.01',
  recipient: 'yourname.near',
  refundAddress: 'bc1q...',  // REQUIRED - Your Bitcoin address
  mode: 'manual',
});
// User sends 0.01 BTC to the deposit address on Bitcoin
```

---

## Configuration

### `.env` file (only needed for auto mode with NEAR origin):
```env
NEAR_ACCOUNT_ID=your-account.near
NEAR_PRIVATE_KEY=ed25519:your_private_key_here
NEAR_RPC_URL=https://rpc.mainnet.fastnear.com
NEAR_NETWORK_ID=mainnet
ONE_CLICK_JWT=optional_jwt_token
```

- `ONE
Confidence
80% confidence
Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Ae1

High
Category
analysis-evasion
Content
| `SKILL.md` | This file — **primary AI agent reference** |
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill documents an auto mode that can initiate a real on-chain transfer from a configured NEAR account, but the user-facing guidance around that mode does not prominently require explicit confirmation immediately before funds move. In an agent setting, this increases the risk of unintended irreversible transfers if a prompt, misunderstanding, or automation path triggers auto mode without a clear consent checkpoint.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
## Modes

### Auto Mode (default)
Automatically sends the deposit from the configured NEAR account.

**Use when**: Origin asset is on NEAR and agent has NEAR credentials in `.env`.
Confidence
91% confidence
Finding
The phrase and behavior 'Automatically sends the deposit from the configured NEAR account' indicates autonomous financial action by the agent. In the context of a wallet-enabled skill, autonomous execution is dangerous because LLMs can misinterpret instructions, be prompt-injected, or act on incomplete user intent, causing direct asset loss.

Static analysis

No suspicious patterns detected.