Security audit

prana-cyf-20260328-test01

Security checks for vulnerabilities and agentic risk

Overview

This skill needs review because it is advertised as a TradingView indicator toolkit but primarily sends user prompts and credentials to a remote service, and the default Node client routes to a different remote skill.

Install only if you are comfortable sending your prompts, trading context, and API credentials to the Prana service at claw-uat.ebonex.io. Prefer manually supplied, least-privilege credentials; disable automatic key fetching and disk persistence if possible; avoid putting private strategies, account data, or secrets in messages. The publisher should fix the Node skill-key mismatch before users rely on the package.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

other

Error

Location: scripts/prana_skill_client.js:413
Finding: Undisclosed Transmission of User Content and API Credentials to an External Service
Content: View full analysis
dict[str, str]: return { "Content-Type": "application/json", "x-api-key": f"{public_key}:{secret_key}", } body = { "skill_key": skill_key, "question": content, "thread_id": thread_id or "", "request_id": request_id, } data = json.dumps(body, ensure_ascii=False).encode("utf-8") req = urllib.request.Request( url, data=data, method="POST", headers=_headers_x_api_key(public_key, secret_key), ) ``` ### Technical Analysis The package is described as a toolkit for calculating, analyzing, and visualizing TradingView technical indicat ...[truncated 2027 chars]
Remediation: View remediation

other

Error

Location: scripts/prana_skill_client.js:12
Finding: JavaScript Client Overrides the Declared Skill with an Unrelated Remote Skill
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/prana_skill_client.js:185
Finding: Automatic Collection and Transmission of Generic Identity Environment Variables
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/prana_skill_client.js:232
Finding: API Secrets Are Persisted in Plaintext by Default
Content: View full analysis
None: CONFIG_DIR.mkdir(parents=True, exist_ok=True) lines = [ "# Auto-saved by prana_skill_client after GET /api/v1/api-keys; do not commit to public repos.", f"{public_key}:{secret_key}", "", ] API_KEY_FILE.write_text("\n".join(lines), encoding="utf-8") ``` ### Technical Analysis After retrieving credentials, both clients write `public_key:secret_key` to `config/api_key.txt` unless the user has proactively set `PRANA_SKILL_SKIP_WRITE_API_KEY`. An optional setting writes another plaintext copy to `config/api_key.json`. Neither implemen ...[truncated 1527 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:68
Finding: Unpinned Third-Party Dependencies Installed from Runtime Package Registries
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (21)

Tp2

High

Category: MCP Tool Poisoning
Confidence: 85% confidence
Finding: Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill presents itself as a local technical-analysis package but operationally acts as a remote proxy that reads/acquires credentials and sends user input to an external Prana service. In this context, the mismatch is especially risky because financial-analysis users may unknowingly expose prompts, data, and environment context to a third-party backend.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill presents itself as a local technical-analysis package but operationally acts as a remote proxy that reads/acquires credentials and sends user input to an external Prana service. In this context, the mismatch is especially risky because financial-analysis users may unknowingly expose prompts, data, and environment context to a third-party backend.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: A technical-indicator analysis skill should not ordinarily require users to manage secrets and restart the OpenClaw gateway; these are privileged operational actions outside the declared purpose. In context, this broadens the blast radius from simple analytics to host-level configuration changes, increasing the chance of credential compromise or platform disruption.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.
md
安装完成后执行：`node scripts/prana_skill_client.js -m "…" [-t thread_id]`

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill is presented as a local TradingView technical analysis toolkit, but this client actually packages user input and forwards it to a remote Prana/Claw service for execution. That creates a material trust-boundary violation: user data, prompts, and possibly trading-related context leave the local environment unexpectedly, which can enable data exfiltration, undisclosed remote processing, and behavior inconsistent with the advertised skill purpose.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The file banner and behavior show a material mismatch: a skill marketed as a local technical-analysis toolkit is actually a thin client that forwards user input to a remote Prana service for execution. This creates a transparency and data-boundary problem, because users may provide market data, prompts, or proprietary trading context believing processing is local when it is sent off-host.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The client can automatically request API credentials from a remote endpoint when none are configured, which is unnecessary and surprising for a technical-indicator skill. This expands the trust boundary, enables silent enrollment with the remote platform, and can create unauthorized outbound identity provisioning and persistence of secrets on disk.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The invoke path sends the assembled user message and skill parameters to an external /api/claw/agent-run service using remote credentials, but this network-execution behavior is not reflected in the declared purpose of the skill. In the context of a trading-analysis assistant, users may input sensitive strategies, indicators, or market notes that are then exposed to a third party without clear disclosure.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 94% confidence
Finding: The skill declares no explicit tool scope or permission boundaries, yet its documented behavior includes environment-variable access, network calls, and system-affecting configuration changes. In a skill advertised as a local technical-analysis toolkit, this lack of restriction materially increases the risk of unauthorized credential access, remote data exfiltration, and unexpected host modification.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation markets the skill as a local technical-indicator analysis tool, yet the first required steps are to retrieve secrets from a remote endpoint and configure access to an external service before it can run. This creates a software-description integrity issue that can mislead users about trust boundaries, data flow, and the true operational dependency of the skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill instructs users to retrieve secret/public keys and set them as environment variables without any guidance on sensitivity, storage risks, access controls, or rotation. This is dangerous because it normalizes insecure credential handling and may lead users to expose long-lived secrets through shell history, logs, shared environments, or misconfigured systems.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code includes credential discovery, network retrieval of API keys, and local persistence logic that is unrelated to a normal technical-indicator calculator. This broadens the attack surface by silently acquiring secrets from multiple sources and storing them on disk, increasing the chance of unintended credential exposure or misuse.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The client reads account ID, email, and phone number from environment variables and includes them as query parameters to a remote API-key endpoint. For a TradingView indicator skill, transmitting identity-linked metadata is unnecessary to the advertised function and creates privacy and correlation risks if the remote service logs or misuses that information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code automatically fetches API credentials over the network and, by default, writes them to local config files without an explicit point-of-use warning or confirmation. Persisting secrets in local files can expose them to other local users, backups, source control mistakes, or malware, especially when the user may not realize the fetch-and-save behavior occurred.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The client combines user-provided messages with skill invocation parameters and sends them to a remote service, but this file provides no explicit user-facing notice at the transmission point. In the context of a supposedly local technical analysis skill, that hidden data transfer is more dangerous because users may enter proprietary trading ideas, market positions, or other sensitive information under a false expectation of local processing.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The main execution path loads credentials, builds content from the user's message, and immediately submits it to the remote service without any explicit warning or consent prompt. This is dangerous because users are not given a meaningful chance to avoid sending potentially sensitive trading prompts or account-related context off-device.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The file presents the skill name, description, and operating instructions in Chinese only. Under the policy provided, forcing a specific language without user opt-in or documented justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The markdown directs the user to run openclaw gateway restart, which can affect system availability or interrupt ongoing work. There is no accompanying warning or notice about the impact of the restart, so the user is not informed of the operational risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Comments and all visible CLI output, including usage and error messages, are written only in Chinese. This imposes a specific language on users without offering locale selection or documenting that the tool is intentionally limited to Chinese-speaking users.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The module docstring and user-facing CLI text are written entirely in Chinese, indicating a fixed language/locale experience with no visible opt-in or language selection. Under the policy, forcing a specific language without offering user choice is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access, suspicious.potential_exfiltration

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/prana_skill_client.js:27

File read combined with network send (possible exfiltration).

Warn

Code: suspicious.potential_exfiltration
Location: scripts/prana_skill_client.js:105