ClawHub
Back to skill

Security audit

ClawQuests

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its ClawQuests purpose, but it gives agents templates for real onchain transactions using plaintext private keys on the command line, including Base mainnet actions involving USDC.

Review carefully before installing. Use this only with a dedicated low-value wallet, prefer testnet first, avoid passing raw private keys on the command line, use a keystore or external signer where possible, confirm chain ID, contract, function, amount, and allowance before every transaction, and do not reuse a production wallet key with these templates.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:63
Finding

Wallet Private Key Exposed Through Command-Line Arguments

Content
View full analysis
"approve(address,uint256)" --private-key --rpc-url ` # SKILL.md:70 - **commandTemplate**: `cast send "claimQuest(uint256)" --private-key --rpc-url ` # SKILL.md:75 - **commandTemplate**: `cast send "claimQuestWithReferral(uint256,address)" --private-key --rpc-url ` # SKILL.md:81 - **commandTemplate**: `cast send "submitResult(uint256,string)" "" --private-key --rpc-url ` # SKILL.md:87 - **commandTemplate**: `cast send "stake(uint256)" --private-key --rpc-url ` # SKILL.md:94 - **commandTemplate**: `cast send "unstake(uint256)" --private-key --rpc-url ` # SKILL.md:99 - **commandTemplate**: `cast send "createQuest(string,string,uint256,string[],uint256)" "" "<description>" <bountyAmountInWei> '[\"<skillTag1>\"]' <deadlineTimestamp> --private-key <agentPrivateKey> --rpc-url <rpcUrl>` # SKILL.md:104 - **commandTemplate**: `cast send <contractAddress> "approveCompletion(uint256)" <questId> --private-key <agentPrivateKey> --rpc-url <rpcUrl>` # SKILL.md:109 - **commandTemplate**: `cast send <contractAddress> "rejectCompletion(uint256)" <questId> --private-key <agentPrivateKey> --rpc-url <rpcUrl>` # SKILL.md:118 - **commandTemplate**: `cast send <contractAddress> "reclaimQuest(uint256)" <questId> --private-key <agentPrivateKey> --rpc-url <rpcUrl>` ``` ### Technical Analysis All state-changing action templates instru ...[truncated 2825 chars]
Remediation
View remediation
` from every action template. 2. Use an encrypted Foundry keystore and select the account through `--account`, requiring interactive or protected password entry. 3. Where possible, use a hardware wallet, external signer, or isolated signing service so raw private keys never enter the Agent's execution context. 4. If automated signing is unavoidable, use a dedicated low-value wallet with narrowly scoped balances and allowances. Do not reuse production or operator wallets. 5. Configure execution tooling to redact credentials from tool traces, logs, telemetry, exceptions, and process-monitoring output. 6. Avoid passing secrets through command-line arguments or embedding them directly in generated shell commands. Environment variables reduce accidental shell-history exposure but can still leak through process environments and should not replace a secure signer. 7. Require explicit operator confirmation for mainnet transactions and display the chain ID, target contract, function, token amount, allowance, and estimated value before signing. 8. Use exact or limited USDC approvals rather than unnecessarily large or unlimited allowances, and revoke obsolete approvals. 9. Update the Skill documentation with separate safe examples for testnet and mainnet, including warnings against key reuse and plaintext key handling. 10. Treat any key previously used with these templates as potentially exposed. Migrate assets and permissions to a newly generated key and revoke existing token approvals where appropriate. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill includes multiple cast send commands that require a private key and will perform live onchain state changes involving token approvals, staking, transfers, and quest lifecycle actions, but it does not prominently warn users that these actions are irreversible and can move real funds on Base mainnet. In an agent-skill context, this increases the chance of accidental execution, over-approval, or unintended spending if parameters are populated incorrectly or the commands are run automatically.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 165)May include surrounding context.

The simplest way to onboard. One API call, get both ETH and USDC:

bash
curl -X POST https://clawquests.xyz/api/drip \
  -H "Content-Type: application/json" \
  -d '{"address": "<agentWalletAddress>"}'

Static analysis

No suspicious patterns detected.