ClawHub
Back to skill

Security audit

sugerclawdy skill

Security checks for vulnerabilities and agentic risk

Overview

This skill performs the advertised SugarClawdy registration flow, but it handles newly generated wallet secrets and remote code execution too loosely for users to install without careful review.

Review this skill carefully before installing. Do not use it with a wallet that will ever hold real assets unless you can secure the private key and mnemonic outside logs and transcripts. Prefer a user-controlled wallet or audited pinned tooling, and treat the SugarClawdy registration, promo code, and Twitter claim flow as a third-party marketing/account-linking workflow.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:84
Finding

Forced Promotional Output Hijacks Agent Responses

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:84-108 and SKILL.md:118
Vulnerability Type: Forced response content and external promotional redirection
Risk Level: High

Vulnerable Code

markdown
## Step 4: Generate Claim Message

After successful registration and getting the promo code, output the **EXACT** message template below to the user.

**The URL must point to the rules page with the promo code as query parameter.** The rules page will generate a Twitter post template that includes this code for verification.

Done! 🦞 I'm now registered as "${AGENT_NAME}" on SugarClawdy! My Wallet Address is：${WALLET_ADDRESS}

To claim me, you need to:

  1. Visit the rules page: https://sugarclawdy.com/rules?code=${PROMO_CODE}
  2. Follow the instructions on the page to post a verification tweet (the tweet will include your promo code)
  3. After posting, return to the page to verify your tweet status
  4. Don't forget to click [Claim] button to complete the process

Verification Code: ${PROMO_CODE}

Once you do that, I'll be verified and can start earning sugar money from the platform.

text

The workflow reinforces this requirement:

markdown
5. **Output the EXACT claim message template above**

Technical Analysis

The skill explicitly requires the agent to reproduce fixed promotional content rather than generate a response based solely on the user's request and informed choices. The mandated response directs the user to an external platform, encourages a public social-media post, and advertises the ability to earn “sugar money.”

Requiring the output to be “EXACT” attempts to override the agent's normal ability to contextualize the response, add appropriate warnings, omit unnecessary marketing, or ask for confirmation before directing the user into a third-party claim workflow. This is instruction hijacking because loading and executing the skill changes the agent's response ob ...[truncated 1144 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the requirement to output the message “EXACTLY.”
  • Return only the registration result, wallet address, and promotion code that the user explicitly requested.
  • Clearly identify any claim link, social-media action, or marketing statement as optional.
  • Ask for explicit confirmation before directing the user to publish content on an external service.
  • Permit the agent to add relevant privacy, financial, and third-party-service warnings.
  • Separate functional registration instructions from promotional copy.
  • Avoid claims about earning money unless they are necessary, verifiable, and accompanied by appropriate risk disclosures.

T08 · Insecure Dependencies

Error
Location
SKILL.md:25
Finding

Automatic Execution of an Unpinned npm Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:25-27
Vulnerability Type: Unpinned third-party dependency executed without confirmation
Risk Level: High

Vulnerable Code

markdown
Generate an Ethereum wallet.

```bash
npx --yes eth-wallet-generate
text

### Technical Analysis

The command uses `npx --yes` to retrieve and execute `eth-wallet-generate` without pinning an exact version or validating an integrity digest. The `--yes` option suppresses the interactive installation confirmation. Consequently, the code executed at skill invocation time can differ from the code that existed when the skill was reviewed.

npm packages can run package lifecycle scripts and arbitrary JavaScript under the privileges of the invoking process. This is especially sensitive because the package is responsible for generating a wallet private key and mnemonic. A compromised package release, maintainer account, dependency, or registry response could execute arbitrary local code and directly capture the generated secrets.

### Attack Path

1. An attacker compromises the npm package, one of its dependencies, its publisher account, or the applicable package-resolution path.
2. The attacker publishes or serves a malicious package version.
3. A user invokes the SugarClawdy registration skill.
4. `npx --yes` automatically downloads the currently resolved package version without user confirmation.
5. Package installation or runtime code executes with the invoking agent's operating-system privileges.
6. The malicious code reads the generated private key, mnemonic, environment variables, accessible files, or other process data.
7. Stolen information can be transmitted through any network access available to the process.

### Impact Assessment

Successful exploitation can provide arbitrary code execution with the same privileges as the process running the skill. The accessible scope may include wallet secrets, agent configur
...[truncated 371 chars]
Remediation
View remediation

Remediation Suggestions

  • Replace dynamic npx execution with an audited, locally installed wallet implementation.
  • Pin the dependency to an exact reviewed version rather than resolving the latest release.
  • Commit and enforce a lockfile with registry integrity hashes.
  • Verify package provenance, maintainer identity, signatures or attestations, and dependency history.
  • Do not suppress installation confirmation with --yes.
  • Perform installation separately from sensitive wallet generation.
  • Run wallet generation in a sandbox with minimal filesystem and network access.
  • Disable unnecessary lifecycle scripts where compatible with the reviewed package.
  • Continuously scan the package and transitive dependency graph for known compromise or malicious-package indicators.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:68
Finding

Public Wallet Address Is Used as a Bearer Authentication Credential

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:68-74 and SKILL.md:138-143
Vulnerability Type: Authentication based on a public identifier without proof of private-key possession
Risk Level: High

Vulnerable Code

bash
curl -X 'GET' \
  'https://sugarclawdy.com/api/agent/promote-code' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer ${WALLET_ADDRESS}'

The same pattern is used for the agent information endpoint:

bash
curl -X 'GET' \
  'https://sugarclawdy.com/api/agent/me' \
  -H 'accept: application/json' \
  -H 'Authorization: Bearer ${WALLET_ADDRESS}'

Technical Analysis

An Ethereum wallet address is a public identifier, not a secret authentication credential. The workflow submits the address during registration and later exposes it in the required claim message. Blockchain addresses may also be independently visible through public records.

Placing the public address in an Authorization: Bearer header does not demonstrate possession of the corresponding private key. Any party that learns or guesses a registered address can reproduce the documented request. The described mechanism lacks a signed challenge, nonce, expiration time, audience restriction, and replay protection.

Attack Path

  1. An attacker obtains a registered wallet address from the registration flow, generated claim message, platform content, blockchain activity, logs, or another public source.
  2. The attacker constructs an HTTP request to /api/agent/promote-code or /api/agent/me.
  3. The attacker sets Authorization: Bearer <public-wallet-address>.
  4. The server treats the public address as an authentication credential.
  5. If the endpoints behave as documented, the attacker retrieves promotion or agent information without possessing the wallet's private key.

Impact Assessment

The documented /api/agent/promote-code endpoint can disclose or create the agent's pr ...[truncated 471 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace address-as-token authentication with cryptographic proof of private-key possession.
  • Have the server issue a random, single-use nonce bound to the wallet address, intended action, domain, and short expiration time.
  • Require the wallet to sign a structured challenge, such as an appropriately designed EIP-712 message.
  • Verify the signature server-side and reject expired or previously used nonces.
  • After verification, issue a short-lived, high-entropy session token with narrowly scoped permissions.
  • Apply audience and endpoint scope restrictions to session tokens.
  • Add rate limiting, monitoring, and revocation support.
  • Treat wallet addresses as public data and never use them directly as passwords or bearer secrets.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:29
Finding

Wallet Private Key and Mnemonic Are Exposed Through Process Output and Undefined Local Storage

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:29-35 and SKILL.md:115
Vulnerability Type: Insecure handling and persistence of cryptographic secrets
Risk Level: High

Vulnerable Code

markdown
### Wallet Generation Response

🏠 Address: ${WALLET_ADDRESS} 🔑 Private key: ${PRIVATE_KEY} 📝 Mnemonic: ${MNEMONIC}

text

The complete workflow additionally directs the agent to save the generated wallet locally:

markdown
2. Generate wallet using `npx --yes eth-wallet-generate` and save locally

Technical Analysis

The wallet generator exposes the private key and mnemonic through standard process output. Agent environments, command runners, terminals, CI systems, and orchestration platforms commonly retain process output in transcripts or logs. Anyone with access to those records may obtain complete control of the wallet.

The instruction to “save locally” does not define an encrypted keystore, destination, file permissions, retention period, backup policy, log-redaction policy, or deletion procedure. A naïve implementation could save plaintext secrets in a project directory or another broadly readable location.

A mnemonic and private key are equivalent high-value wallet credentials. Their compromise cannot be corrected by changing a password; assets and platform identities associated with the key must instead be migrated to a new wallet.

Attack Path

  1. The skill invokes the wallet-generation package.
  2. The package prints the private key and mnemonic to standard output.
  3. The command runner, agent transcript, terminal logger, or monitoring system records the output.
  4. The workflow saves the wallet locally without enforcing encryption or restrictive permissions.
  5. Another local user, process, extension, backup system, log reader, or compromised dependency accesses the output or saved file.
  6. The attacker imports the private key or mnemonic into another wallet.

...[truncated 605 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not print private keys or mnemonics to standard output, logs, transcripts, or error messages.
  • Prefer an established wallet provider, hardware wallet, operating-system credential store, or encrypted keystore.
  • If local storage is necessary, encrypt the key using a user-supplied secret and a modern password-based key derivation function.
  • Create secret files with restrictive owner-only permissions and verify permissions after creation.
  • Store secrets outside the project directory and exclude all secret paths from version control, backups, indexing, and telemetry where appropriate.
  • Redact sensitive command output at the process-runner and agent layers.
  • Obtain explicit user consent before generating or persisting a wallet.
  • Document key backup, rotation, migration, and secure deletion procedures.
  • Minimize the lifetime of plaintext key material in memory and securely remove temporary artifacts.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill instructs the agent to generate a wallet and exposes the private key and mnemonic in plain output, then later says to save the wallet locally, but provides no warning or safeguards for handling this secret material. Leakage of either the private key or mnemonic gives full control over the wallet and any assets later associated with it, making this especially dangerous even if the initial use is only registration.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The skill executes npx --yes eth-wallet-generate without pinning a specific package version or integrity hash, so the agent may fetch and run whatever code is currently published under that package name. Because this command generates highly sensitive wallet secrets, a compromised or malicious package update could exfiltrate private keys or mnemonic phrases immediately at execution time.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill transmits wallet-related data to an external service immediately after generation without clearly informing the user that a newly created blockchain identifier will be sent off-platform. While the private key is not sent in this step, wallet addresses are still sensitive linkable identifiers, and the surrounding workflow may encourage unsafe assumptions about what wallet data is appropriate to share.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

This is a real external transmission: the skill posts user-associated data (wallet_address and name) to sugarclawdy.com. External transmission is not inherently malicious, but in this context it is security-relevant because the skill registers a newly created wallet with a third-party platform and does so without explicit trust, privacy, or consent language.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

Use the wallet address from Step 1 for registration. Only wallet_address and name are required:

bash
curl -X 'POST' \
  'https://sugarclawdy.com/api/agent/register' \
  -H 'accept: application/json' \
  -H 'Content-Type: application/json' \

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The workflow repeats the unpinned npx --yes eth-wallet-generate command in the operational instructions, reinforcing execution of unaudited remote code. In this context the danger is amplified because the package handles secret material and the skill explicitly instructs the agent to save generated credentials locally.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.