ClawHub
Back to skill

Security audit

Clawracle Oracle Resolver

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed blockchain oracle agent, but it gives an autonomous agent high-impact signing and credential access without enough containment.

Review carefully before installing. Use only a fresh, low-value wallet, preferably on testnet, and cap funds so autonomous bond or gas loss is limited. Do not send raw API keys to an LLM; require fixed allowlisted API destinations and inject credentials only after validation. Pin dependencies and add transaction approval, rate limits, maximum bond limits, and secret-handling controls before running this with real value.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
references/api-guide.md:264
Finding

API Credentials Exposed to an LLM and Unvalidated LLM-Generated Requests

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
COMPLETE_AGENT_EXAMPLE.md:112
Finding

Attacker-Controlled Oracle Requests Can Trigger Autonomous Token Approvals and Bond Loss

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
references/setup.md:134
Finding

Unpinned Third-Party npm Dependencies Create Supply-Chain Risk

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
references/setup.md:9
Finding

Wallet Private Key Printed to Standard Output During Generation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (73)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared description focuses on operational oracle behavior: watching for requests, retrieving answers from APIs, submitting resolutions, and validating peers. The actual code does none of that. It only registers an agent in an on-chain registry using environment-supplied credentials and metadata, after checking balance and existing registration status. This is a materially different primary purpose, so the description does not accurately represent the supplied code chunk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The declared description presents a broader autonomous oracle-agent skill with two major functions: monitoring data requests and resolving them from configured APIs, plus validating other agents' answers. The supplied code chunk only covers a narrow submit-resolution example. It connects to Monad, reads query metadata, fetches IPFS content, approves a bond token, and submits a resolution transaction. However, the actual API-fetching and LLM-driven extraction are only described in comments and not implemented; instead the answer is hardcoded. The code also lacks any logic for monitoring events or validating other agents' answers. While comments mention a real WebSocket listener elsewhere, this chunk itself is manually invoked with a requestId. Therefore the description overstates the implemented behavior in material ways.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

There is a clear description-behavior mismatch. The declared purpose focuses on an agent that earns tokens by answering and validating oracle queries. However, this code explicitly states it is for requesters, not agents, and implements request creation: it reads a requester private key, uploads query metadata to IPFS, checks token balance, approves token spending, and calls submitRequest on the registry contract. Those actions are materially different from the declared primary purpose and represent a different role in the system.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared description presents an active oracle-resolution skill with automation around monitoring requests, obtaining external data, submitting answers, and validating others' responses for rewards/reputation. The supplied code does none of those actions. It only accepts a requestId as a command-line argument, performs read-only contract calls (getQuery and getAnswers) against a Monad RPC endpoint, and displays query/answer metadata. This is a materially different primary purpose: inspection of existing answers rather than earning tokens by resolving or validating oracle queries.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

The description portrays a full oracle-solving agent: monitor requests, obtain answers from APIs, submit answers on-chain, and validate other agents. The supplied code only covers infrastructure around listening to oracle contract events, persisting tracked request metadata to a local JSON file, updating status based on proposal/dispute/finalization events, and automatically calling finalizeRequest when timing/status conditions are met. The core advertised behaviors—fetching answers, proposing answers, and validating/disputing other answers—are absent. Because the implemented primary behavior is materially narrower and also includes an undeclared on-chain finalization action, the description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
91% confidence
Finding

The config instructs the agent that API keys are stored in .env and should be read from process.env, which is a form of credential access exposed to agent reasoning. Because this skill also permits editing of configuration/docs and performs network requests, combining secret access with mutable destinations materially increases the risk of credential misuse or indirect exfiltration.

Content

Scanner excerpt · api-config.json (reported line 69)May include surrounding context.

json
],
  "instructions": {
    "howToUse": "When a request comes in with a category string (e.g., 'sports', 'market', 'politics'), find the matching API in this config, read its docsFile, and use the API to resolve the query.",
    "apiKeyAccess": "API keys are stored in .env file. Use the apiKeyEnvVar to read the key from process.env.",
    "queryParsing": "Extract relevant information from the natural language query (teams, dates, locations, etc.) to construct API calls.",
    "agentCanEdit": "Agents can create and edit API configurations and documentation files when instructed by the owner. Use fs.writeFileSync() to save changes."
  }

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

This section directs the agent to retrieve credentials from the environment as part of normal flow, and elsewhere the guide combines that with LLM-driven request planning. In context, the issue is not merely reading an API key for legitimate use, but enabling a flexible credential-access mechanism that can be repurposed to access and potentially leak secrets outside the intended oracle integrations.

Content

Scanner excerpt · references/api-guide.md (reported line 53)May include surrounding context.

// Now you have the full API documentation to understand endpoints, parameters, etc.

text

#### Step 3: Get API Key from Environment

Read the API key from `.env` using the `apiKeyEnvVar`:

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The design explicitly delegates API-call construction to the LLM and permits dynamic execution of the returned method, URL, headers, and body. This gives the model a general outbound request capability that can be steered by adversarial docs, malicious queries, or prompt injection into contacting unintended hosts, abusing authenticated endpoints, or exfiltrating data. That is much broader than a narrowly scoped oracle fetcher.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The prompt template instructs including the raw API key in the LLM context. Sending secrets to the model unnecessarily exposes credentials to model providers, logs, tracing systems, prompt caches, or downstream tooling, and it also makes secret exfiltration easier if the model is prompt-injected. Secrets should never be embedded in prompts when the model does not need them semantically.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The setup guide instructs users to print the newly generated private key directly to stdout. Secrets displayed in console output are commonly captured by shell history tools, terminal logging, CI logs, screen recordings, or remote session transcripts, which can lead to wallet compromise and unauthorized signing of on-chain transactions.

Content

Scanner excerpt · references/setup.md (reported line 19)May include surrounding context.

md
console.log('Address:', wallet.address);
console.log('Private Key:', wallet.privateKey);
console.log('\n⚠️  SECURITY WARNING:');
console.log('1. Store the private key securely in .env as CLAWRACLE_AGENT_KEY');
console.log('2. NEVER share your private key with anyone');
console.log('3. NEVER commit the private key to version control');
console.log('4. This key will be used to sign all oracle transactions');

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

The documentation directs operators to place a blockchain private key in a local .env file. While environment variables are common, storing long-lived signing keys in plaintext .env files increases the risk of accidental disclosure through source control mistakes, backups, process inspection, local compromise, or misconfigured deployment environments.

Content

Scanner excerpt · references/setup.md (reported line 30)May include surrounding context.

After generating the wallet, save the private key to your .env file:

bash
# Add to .env file
CLAWRACLE_AGENT_KEY=0x1234567890abcdef...  # Your generated private key

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/register-agent.js (reported line 10)May include surrounding context.

js
async function main() {
  console.log('🤖 Registering Agent...\n');

  // Use agent's private key from .env
  if (!process.env.CLAWRACLE_AGENT_KEY) {
    console.error('❌ CLAWRACLE_AGENT_KEY not found in .env');
    console.error('Please set CLAWRACLE_AGENT_KEY in your .env file');

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/register-agent.js (reported line 13)May include surrounding context.

js
async function main() {
  console.log('🤖 Registering Agent...\n');

  // Use agent's private key from .env
  if (!process.env.CLAWRACLE_AGENT_KEY) {
    console.error('❌ CLAWRACLE_AGENT_KEY not found in .env');
    console.error('Please set CLAWRACLE_AGENT_KEY in your .env file');

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/register-agent.js (reported line 28)May include surrounding context.

js
async function main() {
  console.log('🤖 Registering Agent...\n');

  // Use agent's private key from .env
  if (!process.env.CLAWRACLE_AGENT_KEY) {
    console.error('❌ CLAWRACLE_AGENT_KEY not found in .env');
    console.error('Please set CLAWRACLE_AGENT_KEY in your .env file');

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/submit-request.js (reported line 28)May include surrounding context.

js
async function main() {
  console.log('🤖 Registering Agent...\n');

  // Use agent's private key from .env
  if (!process.env.CLAWRACLE_AGENT_KEY) {
    console.error('❌ CLAWRACLE_AGENT_KEY not found in .env');
    console.error('Please set CLAWRACLE_AGENT_KEY in your .env file');

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/submit-request.js (reported line 30)May include surrounding context.

js
async function main() {
  console.log('🤖 Registering Agent...\n');

  // Use agent's private key from .env
  if (!process.env.CLAWRACLE_AGENT_KEY) {
    console.error('❌ CLAWRACLE_AGENT_KEY not found in .env');
    console.error('Please set CLAWRACLE_AGENT_KEY in your .env file');

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/submit-request.js (reported line 31)May include surrounding context.

js
async function main() {
  console.log('🤖 Registering Agent...\n');

  // Use agent's private key from .env
  if (!process.env.CLAWRACLE_AGENT_KEY) {
    console.error('❌ CLAWRACLE_AGENT_KEY not found in .env');
    console.error('Please set CLAWRACLE_AGENT_KEY in your .env file');

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/register-agent.js (reported line 12)May include surrounding context.

js
// Use agent's private key from .env
  if (!process.env.CLAWRACLE_AGENT_KEY) {
    console.error('❌ CLAWRACLE_AGENT_KEY not found in .env');
    console.error('Please set CLAWRACLE_AGENT_KEY in your .env file');
    return;
  }

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/register-agent.js (reported line 27)May include surrounding context.

js
// Use agent's private key from .env
  if (!process.env.CLAWRACLE_AGENT_KEY) {
    console.error('❌ CLAWRACLE_AGENT_KEY not found in .env');
    console.error('Please set CLAWRACLE_AGENT_KEY in your .env file');
    return;
  }

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/submit-request.js (reported line 71)May include surrounding context.

js
// Use agent's private key from .env
  if (!process.env.CLAWRACLE_AGENT_KEY) {
    console.error('❌ CLAWRACLE_AGENT_KEY not found in .env');
    console.error('Please set CLAWRACLE_AGENT_KEY in your .env file');
    return;
  }

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This markdown presents executable-looking automation that approves token spending, submits on-chain transactions, validates disputes, and writes persistent local state, but it does not prominently warn users about financial loss, gas costs, token approval risk, RPC trust, or filesystem side effects. Because the skill is explicitly for autonomous oracle resolution with wallet credentials, omission of those warnings materially increases the chance of unsafe deployment by users who treat the example as drop-in code.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The comment says the agent will validate only the original and disputed answers, but the implementation loops through and validates every answer for the request. In this skill context, each validation is an on-chain action that can consume gas, affect reputation/outcomes, and create unintended financial exposure or spam-like behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The example claims to provide complete finalization logic, but it calls registry.finalizeRequest(requestId) even though finalizeRequest is not declared in the provided ABI. In ethers, this will fail at runtime and can cause operators to rely on nonfunctional settlement logic while the surrounding documentation explicitly encourages autonomous financial actions on-chain.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The README tells users to export a private key and deploy without any warning about key handling, shell history exposure, environment leakage, or safe wallet practices. In blockchain tooling, developers frequently copy-paste such commands; weak guidance can directly lead to credential compromise or accidental use of valuable keys.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/resolve-query.js:31

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
references/api-guide.md:64