ClawHub
Back to skill

Security audit

Warden Messari Agent

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent guide for querying a paid crypto research agent, but its payment instructions could authorize real USDC transfers without enough local spending controls or confirmation guidance.

Review the payment path before installing or using this skill. Use a low-balance dedicated wallet, require explicit approval for every paid request, and enforce local checks for network, USDC contract, recipient, amount, facilitator, and authorization expiry before signing. Pin and review any x402 client dependency instead of installing an unconstrained latest package.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:201
Finding

Remote Payment Parameters Are Signed Without a Mandatory Local Spending Policy

Content
View full analysis
` The client does NOT submit a blockchain transaction. The authorization is gasless. The x402 facilitator submits the signed transfer on-chain on behalf of the client. ``` ### Technical Analysis The documented procedure instructs clients to parse payment parameters supplied by the remote endpoint and sign an EIP-3009 transfer authorization. It does not require the client to independently validate the requested network, token contract, recipient, transfer amount, authorization lifetime, or facilitator against a trusted local policy. The Skill states that a request costs $0.25 USDC, but the signing flow does not mandate an enforcement check that rejects any authorization exceeding that amount. It also does not require explicit user approval after displaying the final typed-data fields. An EIP-3009 authorization is not merely an authentication signature. It can authorize an on-chain token transfer when submitted by a facilitator. Consequently, blindly signing server-provided parameters exceeds the minimum privilege needed to pay the advertised fixed request price. ### Attack Path 1. The user or agent contacts the documented endpoint and receives an HTTP 402 response. 2. The endpoint, an intermediary, or compromised service supplies manipulated `PAYMENT-REQUIRED` parameters. 3. Th ...[truncated 1041 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:220
Finding

Unpinned npm Dependency Is Installed Into a Wallet-Capable Environment

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 19)May include surrounding context.

md
curl -s https://messari.agents.wardenprotocol.org/.well-known/agent-card.json | jq .

# Send a query (will return 402 if payments are enabled)
curl -s -X POST https://messari.agents.wardenprotocol.org/ \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

}

text

### Minimal curl Example (Without Payment)

This will return a 402 if payments are enabled. Useful for testing connectivity.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The payment section describes how to construct and submit a signed X-PAYMENT authorization, but it does not prominently warn users that a successful request can trigger a real USDC transfer. In a skill that facilitates paid requests, weak disclosure can cause unintended financial loss, especially if an agent or user automates repeated queries without clear consent boundaries.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 228)May include surrounding context.

typescript
import { paymentFetch } from "@x402/client";

const response = await paymentFetch(
  "https://messari.agents.wardenprotocol.org/",
  {
    method: "POST",

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The quick reference at L019 says a 'streaming query' can be sent with JSON-RPC SSE, but the capability section at L025 explicitly says streaming is not supported in the current version. This is an active contradiction in the file's own documentation about supported behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The message-parts table documents file and data request structures as usable types, but L164 states that this specific agent only accepts and returns text parts. That creates an intent/documentation contradiction about what inputs are actually supported for this skill.

Content

No source excerpt is available for this finding.