ClawHub
Back to skill

Security audit

Api3 Feed Manager Readonly

Security checks for vulnerabilities and agentic risk

Overview

This skill is a read-only Api3 feed planning tool that fetches public/RPC data and prepares reviewable transaction details without signing or submitting transactions.

Before installing, scope the skill to read-only network use, provide only RPC endpoints you trust, and review any generated contract target, value, and calldata before handing it to a wallet or executor. For stronger supply-chain assurance, prefer a release with pinned dependencies and a committed lockfile.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill advertises read-only, non-executing behavior, but it does not declare an explicit tool/permission scope despite requiring network capability. That mismatch can allow an agent runtime to grant broader access than reviewers or downstream users expect, increasing the risk of unintended external requests, data exfiltration, or future capability creep hidden behind a 'readonly' label.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"check": "node --check scripts/api3-feed-manager-readonly.js && node --check scripts/bin/api3-feed-manager-readonly.js"
  },
  "dependencies": {
    "@api3/contracts": "^37.0.0",
    "@api3/dapi-management": "^4.13.0",
    "ethers": "^6.15.0"
  }
Confidence
90% confidence
Finding
The dependency is version-ranged with a caret, which allows future non-major releases to be installed. That increases supply-chain risk because a compromised or broken upstream minor/patch release could be pulled in without review, affecting consumers of the skill even though this package itself is read-only.

Unpinned Dependencies

Low
Category
Supply Chain
Content
},
  "dependencies": {
    "@api3/contracts": "^37.0.0",
    "@api3/dapi-management": "^4.13.0",
    "ethers": "^6.15.0"
  }
}
Confidence
90% confidence
Finding
Using a caret range for this package permits automatic uptake of later compatible releases, which weakens build reproducibility and exposes the project to upstream supply-chain compromise or unexpected behavior changes. In a blockchain-related skill, dependency integrity matters because library behavior can influence generated transaction data and feed analysis outputs.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"dependencies": {
    "@api3/contracts": "^37.0.0",
    "@api3/dapi-management": "^4.13.0",
    "ethers": "^6.15.0"
  }
}
Confidence
92% confidence
Finding
The ethers dependency is not strictly pinned, so installs may resolve to newer patch/minor releases over time. Because this library is central to blockchain encoding and RPC interaction, an upstream compromise or regression could alter outputs or introduce malicious behavior despite the skill's stated read-only purpose.

Static analysis

No suspicious patterns detected.