ClawHub
Back to skill

Security audit

Crypto Daily Dashboard

Security checks for vulnerabilities and agentic risk

Overview

This crypto dashboard is mostly purpose-aligned, but it contains an unsafe optional shell command path that can turn an environment variable into local command execution.

Review before installing. Use read-only Binance API keys, do not run this with trading or withdrawal permissions, and do not set ECONOMIC_TRACKER_PATH unless you fully control the target script and launch environment. The shell execution should be fixed before scheduled or unattended use.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
dashboard.js:174
Finding

OS Command Injection via ECONOMIC_TRACKER_PATH

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The code executes a shell command built from the environment-controlled ECONOMIC_TRACKER_PATH using execSync and string interpolation. If an attacker can influence that environment variable, they can inject shell metacharacters or point to an unexpected program, resulting in arbitrary local command execution under the user's privileges.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding

The skill declares executable behavior and explicitly relies on environment variables for sensitive Binance API credentials, but it does not declare any tool scope or permission boundaries. In an agent ecosystem, this weakens reviewability and containment because operators cannot easily see that the skill expects env access and will execute code, increasing the chance of over-privileged execution or unintended secret exposure.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The output example and surrounding troubleshooting text show the dashboard interface in Chinese, but the skill description does not mention that the UI is Chinese-only or provide any language selection. This is a natural-language locale policy concern because it imposes a specific language on users without opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The code defaults CONFIG.locale to 'zh-CN' when LANG is unset, which imposes a specific language/locale choice on users by default. The policy allows locale constraints only when user choice or clear justification is provided, neither of which is present here.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · dashboard.js (reported line 135)May include surrounding context.

js
async function getCryptoPrices() {
  // Try CoinGecko first (free, no API key)
  const coins = ['bitcoin', 'ethereum', 'solana'];
  const cgUrl = `https://api.coingecko.com/api/v3/simple/price?ids=${coins.join(',')}&vs_currencies=usd&include_24hr_change=true`;
  const cg = await httpsGet(cgUrl);
  
  if (cg && cg.bitcoin && cg.bitcoin.usd) {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · dashboard.js (reported line 165)May include surrounding context.

js
}

async function getFearGreedIndex() {
  const url = 'https://api.alternative.me/fng/?limit=1';
  return await httpsGet(url);
}

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The ECONOMIC_TRACKER_PATH value is passed directly into a shell command without validation or escaping. This is not just a missing warning; it is a command injection sink, because shell parsing will treat crafted characters in the path as additional commands.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
dashboard.js:195