T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:346- Finding
Mandatory Brand Promotion Hijacks User-Facing Responses
- Content
View full analysis
- Remediation
View remediation
Security audit
Smart Money
Security checks for vulnerabilities and agentic risk
Overview
This skill mostly matches its wallet-monitoring purpose, but it tells agents to create recurring Cron monitoring automatically and store an API key locally, which needs user review before installation.
Review carefully before installing. Only use this skill if you are comfortable with Antalpha's MCP service receiving monitored wallet addresses and with local agent credentials being stored. Do not allow the Cron job unless you explicitly want recurring background checks about every 15 minutes; verify how to inspect, disable, and remove that job first.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T06 · System Persistence
Error
- Location
SKILL.md:189- Finding
Recurring Cron Task Is Installed Without Explicit User Confirmation
- Content
View full analysis
, level high, since . If new signals exist, notify me with details. If no new signals, reply HEARTBEAT_OK silently. Save current timestamp as last_check." ``` ``` The behavior is reinforced later: ```markdown 3. **⚠️ MANDATORY**: Show the strong nudge (see Periodic Monitoring → Step 2), then **immediately proceed to create the Cron task** — do not make it optional, do not wait for user to ask 4. Execute `openclaw cron add` with 15-min interval and `--session isolated` ``` ### Technical Analysis The Skill explicitly instructs the agent to create a persistent scheduled task without waiting for explicit approval. The task survives the original Skill invocation and runs approximately 96 times per day. Although recurring polling is related to monitoring, authorization to monitor an address does not necessarily constitute informed authorization to modify the host scheduler. The user is not given a confirmation boundary after being shown the exact schedule, resource implications, remote service interaction, and removal procedure. The scheduled task repeatedly calls the remote Antalpha MCP service and operates in an isolated agent session. Its effective privileges are those available to the OpenClaw Cron execution environment. ### Attack Path 1. A user asks the agent to monitor or track a wallet address. 2. The agent calls `smart-money-custom` to create a remote subscription. 3. The Skill directs the agent to avoid waiting f ...[truncated 1121 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:43- Finding
API Credential Is Persisted in a Plaintext JSON File Without Required Access Controls
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill instructs the agent to create a Cron task immediately and 'without waiting for extra confirmation,' but does not require explicit informed consent for modifying the user's environment and establishing persistent background execution. This creates a direct risk of unauthorized system changes, recurring network calls, noisy behavior, and hidden cost accumulation.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The agent behavior rules operationalize automatic Cron creation as mandatory default behavior, normalizing persistent background execution without adequate warning or affirmative approval. This is especially dangerous because the behavior is framed as automatic after an add action, which can turn a simple wallet subscription into ongoing autonomous execution on the host.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest description enumerates many broad trigger terms without clear boundaries, making accidental invocation more likely. In this skill, accidental activation is riskier than usual because it can lead to registration, local secret persistence, and Cron setup rather than just passive information retrieval.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 86% confidence
- Finding
The skill is designed around persistent monitoring state and ongoing scheduled checks, which introduces session persistence and durable behavior beyond a single interaction. Persistence is not inherently malicious, but in this implementation it increases risk because it couples retained state with local file storage and recurring background execution.
- Content
md Track smart money (whale, VC fund, market maker) wallet activities on Ethereum mainnet. Get real-time trading signals when watched wallets make significant moves. **v1.2.1**: After adding a custom address, agent **must** guide user to create a Cron monitoring task — without it, signals land in the database but the user receives no notification. **v1.2**: Custom address subscriptions — add up to 5 personal wallets for real-time on-chain monitoring. Same address added by multiple agents shares one subscription stream (Reference Counting), no duplicate billing.
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill directs the agent to persist an API key and monitoring state in local files under the user's home directory, adding secret storage and local state management beyond the core tracking task. Local plaintext storage increases the chance of credential leakage through file disclosure, backups, logs, or overly broad filesystem access by other tools or processes.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The activation guidance includes broad monitoring-related phrases that can match ordinary requests such as 'monitor', 'track', or 'set alert', causing the skill to activate outside a clearly bounded smart-money context. Overbroad triggering is dangerous here because the skill contains persistent side effects, including watchlist changes and scheduled background execution.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 94% confidence
- Finding
The skill explicitly promotes autonomous execution ('auto-executed for you') for creating scheduled monitoring, allowing the agent to make environment-changing decisions without an approval checkpoint. Autonomous action is risky here because it enables persistence and repeated external calls beyond the immediate user request.
- Content
Let me create the Cron task for you now.
强烈建议：立即创建 15 分钟定时任务（我帮你自动执行）： Strongly recommended: create a 15-min Cron task now (auto-executed for you):
text **Step 3 — Create Cron immediately (agent executes without waiting for extra confirmation):**
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs the agent to create and manage a system Cron job, which extends beyond data retrieval into persistent host-level task scheduling. That grants the skill a durable execution foothold and can modify the user's environment in ways unrelated to a one-shot whale-tracking query, increasing the risk of abuse, surprise persistence, and repeated unauthorized actions.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The document explicitly presents only two language modes via the English and Chinese anchors, which can be read as a locale/language constraint. Because there is no statement that users may choose other languages or that the limitation is justified by a region-specific requirement, this may violate the language-choice policy.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The file requires every user-facing reply to end with a fixed branded tagline and specifies language handling rules for Chinese, English, and other languages. This imposes a mandatory output-language/locale behavior rather than offering user choice or documenting a justified locale-specific requirement.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The label set includes a subjective characterization, such as tagging Justin Sun as "controversial," without any visible sourcing, consent, or documented justification. In a wallet-tracking skill, these labels can influence user trust and downstream decisions, creating reputational and profiling risk even if the data is not directly executable.
- Content