ClawHub
Back to skill

Security audit

marsbit-crypto-flash-skill

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says by fetching crypto news from MarsBit, but it asks for broader local tool authority than its news lookup purpose needs.

Review before installing. Use it only for public crypto news lookups, avoid including portfolio details, private trading plans, secrets, wallet data, or personal information in prompts that may be sent to MarsBit, and prefer the ClawHub install over the unpinned GitHub fallback. The publisher should narrow permissions by removing unused read access and replacing broad exec with a scoped HTTP/MCP mechanism if the platform supports it.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
package.json:8
Finding

Excessive Local Tool Permissions Violate Least Privilege

Content
View full analysis

Vulnerability Details

File Location: package.json:8-12
Vulnerability Type: Excessive tool permissions
Risk Level: Medium

json
"skills": {
  "dependencies": {
    "tools": ["exec", "read"],
    "binaries": ["curl"],
    "envVars": []
  }
}

Technical Analysis

The skill declares access to both exec and read, although its documented functionality only requires sending HTTP requests to the MarsBit MCP endpoint using curl. No documented workflow requires arbitrary local file-reading capability.

The broad exec capability also exposes a general command-execution interface rather than a narrowly scoped HTTP client. If the OpenClaw runtime enforces these declarations as available capabilities, the skill receives more authority than is necessary for retrieving news.

This violates the principle of least privilege. Untrusted content returned by the remote news service may subsequently be processed by an agent that has access to these capabilities, increasing the consequences of prompt injection or tool-manipulation attacks.

Attack Path

  1. The skill is installed with the declared exec and read capabilities.
  2. The agent retrieves attacker-controlled or compromised content through the remote MCP endpoint.
  3. The content contains instructions designed to induce an unintended tool call.
  4. The agent invokes read to access unrelated local files or uses exec to run commands outside the intended curl workflow.
  5. Data accessible to the OpenClaw process may be disclosed or modified, depending on the command executed and the operating-system permissions of the process.

Exploitation depends on the host agent accepting malicious instructions and exposing the declared tools without additional policy enforcement.

Impact Assessment

An attacker could potentially read files accessible to the OpenClaw process or execute arbitrary commands with the privileges of the account runnin ...[truncated 325 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the unused read capability from the skill manifest.
  • Replace unrestricted exec with a dedicated HTTP or MCP capability where the runtime supports one.
  • Restrict outbound traffic to https://www.marsbit.co/api/mcp.
  • If exec is unavoidable, enforce an allowlist that permits only the expected curl executable and fixed endpoint.
  • Prevent remote response content from controlling command names, command-line options, URLs, headers, or shell syntax.
  • Run the skill under a dedicated low-privilege account with restricted filesystem access and no unnecessary credentials.
  • Apply agent-level confirmation or policy checks before allowing local file access or commands unrelated to the documented news-retrieval workflow.

T08 · Insecure Dependencies

Warning
Location
README.md:58
Finding

GitHub Installation Uses an Unpinned and Unverified Source

Content
View full analysis

Vulnerability Details

File Location: README.md:58-65
Vulnerability Type: Mutable supply-chain dependency
Risk Level: Medium

bash
### 2) Install from GitHub

```bash
git clone https://github.com/domilin/marsbit-crypto-news-skill /tmp/marsbit-crypto-news-skill
mkdir -p ~/.openclaw/skills/marsbit-crypto-news-skill
cp -R /tmp/marsbit-crypto-news-skill/* ~/.openclaw/skills/marsbit-crypto-news-skill/
openclaw skills list
text

### Technical Analysis

The fallback installation procedure clones the repository's mutable default branch and recursively copies its contents into the persistent OpenClaw skill directory. It does not pin a reviewed commit or release and does not verify a cryptographic checksum or signature.

Consequently, the files installed by following these instructions may differ from the audited artifact. A compromised repository, maintainer account, or default branch could introduce malicious skill instructions or executable files after this version has been reviewed.

The recursive wildcard copy also installs any newly added repository files rather than limiting installation to the expected `README.md`, `SKILL.md`, and `package.json` files.

### Attack Path

1. An attacker compromises the upstream repository, its maintainer account, or its release workflow.
2. The attacker modifies the default branch to include malicious instructions, configuration, or executable content.
3. A user follows the documented fallback installation process.
4. `git clone` downloads the current attacker-controlled default branch.
5. `cp -R` copies all fetched content into `~/.openclaw/skills/marsbit-crypto-news-skill/` without integrity verification.
6. OpenClaw discovers the modified skill.
7. When the skill is loaded or invoked, the malicious instructions or files execute within the capabilities granted to the OpenClaw process.

### Impact Assessment

A successful supply-chain compromise could replace
...[truncated 516 chars]
Remediation
View remediation

Remediation Suggestions

  • Install from a specific reviewed commit hash or immutable version tag rather than the default branch.
  • Publish SHA-256 checksums for release artifacts and verify them before installation.
  • Prefer cryptographically signed releases or signed Git tags, and document signature verification.
  • Download a versioned release archive instead of cloning mutable repository state.
  • Copy only an explicit allowlist of expected files rather than recursively copying every repository file.
  • Inspect the fetched commit and compare it with the documented audited version before enabling the skill.
  • Apply the same hardened installation instructions consistently in both README.md and SKILL.md.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 62)May include surrounding context.

bash
git clone https://github.com/domilin/marsbit-crypto-news-skill /tmp/marsbit-crypto-news-skill
mkdir -p ~/.openclaw/skills/marsbit-crypto-news-skill
cp -R /tmp/marsbit-crypto-news-skill/* ~/.openclaw/skills/marsbit-crypto-news-skill/
openclaw skills list

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.

bash
git clone https://github.com/domilin/marsbit-crypto-news-skill /tmp/marsbit-crypto-news-skill
mkdir -p ~/.openclaw/skills/marsbit-crypto-news-skill
cp -R /tmp/marsbit-crypto-news-skill/* ~/.openclaw/skills/marsbit-crypto-news-skill/
openclaw skills list

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This skill depends on curl and is explicitly designed to send HTTP requests to an external hosted MCP endpoint. External transmission is expected for its function, but it still creates a real security boundary crossing: user input and retrieved context leave the local environment and are exposed to the availability, integrity, and privacy properties of a third-party server.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md
---
name: marsbit-crypto-news-skill
description: Crypto-native Web3 news and flash intelligence from MarsBit through hosted MCP. Use this for L1/L2 ecosystems, DeFi/CeFi, regulation, exchange flows, and market-moving events.
metadata: {"openclaw":{"emoji":"📰","requires":{"bins":["curl"]},"install":[{"id":"curl","kind":"brew","formula":"curl","label":"curl (HTTP client)"}],"os":["darwin","linux","win32"]},"version":"0.3.2"}
---

# MarsBit Crypto News Skill (Web3-focused)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs use of a hosted MCP endpoint for all commands but does not warn users that their query contents will be transmitted to a third-party service. In a news skill, users may include trading plans, portfolio details, or investigative context in prompts, creating a privacy and data-governance risk through silent external transmission.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill activates on broadly phrased crypto/Web3 information requests, which can cause it to engage in many normal conversations and automatically route prompts to an external MCP service. That increases the chance of unnecessary third-party data disclosure and unintended tool use, especially when user queries may contain sensitive context or are only tangentially related to market/news lookup.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.