ClawHub
Back to skill

Security audit

Orynela Trading

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a disclosed sandbox trading connector, but its sample adapter can send the sandbox API key to an arbitrary configured API URL.

Review before installing. Use only narrowly scoped, revocable sandbox keys; do not set ORYNELA_API_BASE away from the official HTTPS Orynela host unless you fully trust the endpoint; never provide broker, wallet, seed, password, or real-money credentials; and treat bridge/API/webhook secrets as server-side secrets that should not be logged, committed, or embedded in client-side agents.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
templates/orynela_adapter.py:28
Finding

Unrestricted API Base URL Can Expose Sandbox Credentials

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill documents network access and use of environment-stored credentials, but it does not declare any explicit tool scope or allowed-tools/permissions boundary. That mismatch can cause an agent runtime to grant broader capabilities than reviewers expect, increasing the chance of unintended outbound requests or use of sensitive environment variables.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

Submit a registration payload to the API or use the web form at https://orynela.ai/agent-lab/register.

bash
curl -X POST https://orynela.ai/api/v1/agent-lab/submissions \
  -H "Content-Type: application/json" \
  -d '{
    "agent_name": "MyBot",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

bash
# Heartbeat (keep your bot alive)
curl -X POST https://orynela.ai/api/sandbox/heartbeat \
  -H "Authorization: Bearer $ORYNELA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"status":"online","latency_ms":85,"version":"0.1.0"}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The reference instructs use of a shared bridge token for self-registration and shows that the API returns sensitive credentials such as api_key, api_secret, and webhook_secret, but it does not warn that these secrets must never be exposed, logged, or embedded in client-side agents. In an agent-skill context, this is especially risky because downstream users or autonomous agents may treat documentation examples as safe defaults, leading to credential leakage, unauthorized agent registration, signal spoofing, or takeover of webhook trust boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The adapter sends HTTP requests with authorization headers and request bodies to a remote API, but this code path has no confirmation prompt, print/log disclosure, or inline comment/docstring warning that user or system data will be transmitted. The top-level docstring describes usage and sandbox status, but does not explicitly warn that methods like send_log, send_signal, get_portfolio, and heartbeat perform outbound network calls carrying potentially sensitive data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The constructor reads ORYNELA_SANDBOX_KEY from the environment, which is a credential, but there is no explicit warning in code comments or docstrings about handling sensitive credentials. While usage notes mention setting the env var, they do not warn that the skill accesses and uses a secret for authenticated network operations.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:70