ClawHub
Back to skill

Security audit

Crypto Alert

Security checks for vulnerabilities and agentic risk

Overview

This skill is a simple cryptocurrency price checker that makes disclosed Binance price lookups and does not access private files, credentials, or persistent system settings.

Install this only if you are comfortable with live requests to Binance for price data and with the skill presenting output mainly in Traditional Chinese. Use an isolated virtual environment and consider pinning `requests` before installation. Do not treat the displayed prices or alerts as financial advice.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Note
Location
SKILL.md:12
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Locations:

  • SKILL.md, lines 12–14
  • README.md, lines 15–17

Vulnerability Type: Unpinned dependency and supply-chain exposure
Risk Level: Low

Affected code in SKILL.md (lines 12–14):

bash
pip3 install requests

Affected code in README.md (lines 15–17):

bash
pip3 install requests

Technical Analysis

The installation instructions install requests without constraining its version or verifying package integrity. Consequently, the exact package and transitive dependency versions installed can change over time, making installations non-reproducible.

The dependency name is legitimate, and the reviewed project does not specify a typosquatted package, malicious package repository, or known-compromised version. Nevertheless, an unconstrained installation trusts whichever compatible release the configured Python package index serves at installation time. If a future release or transitive dependency is compromised, substituted through an index or network configuration attack, or introduces a security regression, users following these instructions could install unsafe code without any repository change being visible in this project.

Attack Path

  1. An attacker compromises a future requests release, one of its transitive dependencies, or a package index trusted by the victim.
  2. A user follows the documented pip3 install requests instruction.
  3. Because no version or cryptographic hash is specified, pip resolves and downloads the attacker-controlled or compromised release.
  4. Malicious package code may run during package installation or when crypto.py imports and uses requests.
  5. The payload then executes with the operating-system privileges of the user running pip or the Skill.

This is a conditional supply-chain attack path; no malicious dependency or active exploitation was identified in the audited files.

Impact Assessment

...[truncated 436 chars]

Remediation
View remediation

Remediation Suggestions

  1. Add a dependency manifest and pin requests to a reviewed version:
    text
    requests==<reviewed-version>
  2. Pin all transitive dependencies through a lock file or generated requirements file.
  3. Record cryptographic hashes and require their verification:
    bash
    python3 -m pip install --require-hashes -r requirements.txt
  4. Generate reviewed hashes with an established dependency-locking workflow, such as pip-tools, and commit the resulting lock file.
  5. Update both SKILL.md and README.md to install from the pinned manifest rather than resolving the latest package:
    bash
    python3 -m pip install --require-hashes -r requirements.txt
  6. Periodically scan and deliberately update pinned dependencies after reviewing security advisories and test results.
  7. Avoid running pip with administrative privileges and install the dependencies in an isolated virtual environment.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (7)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The file's user-facing instructions and descriptions are presented only in Traditional Chinese, which imposes a specific language on users without any opt-in or alternative. The policy allows locale constraints only when they are explicitly offered as a choice or clearly justified as region-specific, neither of which is present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The module title and description are presented only in Traditional Chinese, and all user-facing responses in the file are hard-coded in Chinese. This indicates a language preference is being imposed without any visible opt-in, language selection, or documented region-specific justification.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · crypto.py (reported line 35)May include surrounding context.

python
def get_crypto_price(symbol="BTC"):
    """取得加密貨幣價格"""
    try:
        url = f"https://api.binance.com/api/v3/ticker/24hr?symbol={symbol}USDT"
        response = requests.get(url, timeout=10)
        data = response.json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · crypto.py (reported line 53)May include surrounding context.

python
def get_crypto_price(symbol="BTC"):
    """取得加密貨幣價格"""
    try:
        url = f"https://api.binance.com/api/v3/ticker/24hr?symbol={symbol}USDT"
        response = requests.get(url, timeout=10)
        data = response.json()

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
72% confidence
Finding

SQP-3 applies to all file types and includes language or locale policy violations. This file presents all headings, instructions, and status text in a single language with no indication that users may choose another language or that the locale restriction is intentional and documented.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

This is a markdown file, so SQP-2 applies to missing warnings in documentation. The report identifies Binance API as a data source and states the skill can be used directly, but does not include any warning that the skill performs live external network requests or depends on third-party service responses.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The manifest description is written only in Traditional Chinese ("加密貨幣價格監控與提醒") with no indication that language choice is optional or that the skill is intended for a specific locale. This can violate language/locale policy when a skill implicitly enforces one language without user opt-in.

Content

No source excerpt is available for this finding.