marsbit-crypto-news-skill

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 4:52 AM UTC
• Version: 1.0.8

Overview

This skill is a straightforward MarsBit crypto news connector that sends news queries to a disclosed hosted endpoint, with no evidence of hidden persistence, destructive behavior, or credential handling.

Before installing, understand that crypto/Web3 queries, keywords, and requested article IDs are sent to MarsBit's hosted MCP endpoint. Do not include wallet seed phrases, private keys, credentials, proprietary trading plans, or other sensitive material in prompts that may become search parameters.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
git clone https://github.com/domilin/marsbit-crypto-news-skill /tmp/marsbit-crypto-news-skill
mkdir -p ~/.openclaw/skills/marsbit-crypto-news-skill
cp -R /tmp/marsbit-crypto-news-skill/* ~/.openclaw/skills/marsbit-crypto-news-skill/
openclaw skills list
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
git clone https://github.com/domilin/marsbit-crypto-news-skill /tmp/marsbit-crypto-news-skill
mkdir -p ~/.openclaw/skills/marsbit-crypto-news-skill
cp -R /tmp/marsbit-crypto-news-skill/* ~/.openclaw/skills/marsbit-crypto-news-skill/
openclaw skills list
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

External Transmission

Medium

• Category: Data Exfiltration

Content

---
name: marsbit-crypto-news-skill
description: Crypto-native Web3 news and flash intelligence from MarsBit through hosted MCP. Use this for L1/L2 ecosystems, DeFi/CeFi, regulation, exchange flows, and market-moving events.
metadata: {"openclaw":{"emoji":"📰","requires":{"bins":["curl"]},"install":[{"id":"curl","kind":"brew","formula":"curl","label":"curl (HTTP client)"}],"os":["darwin","linux","win32"]},"version":"0.3.2"}
---

# MarsBit Crypto News Skill (Web3-focused)

• Confidence: 84% confidence
• Finding: The skill is designed around curl-based communication with an external hosted service, which means user-supplied keywords and potentially sensitive context are transmitted off-box. While external networking is expected for a news skill, the absence of clear trust boundaries, retention details, and consent language makes this a genuine external-transmission concern rather than a false positive.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly instructs the agent to send requests to a third-party hosted MCP endpoint for user queries, but it does not include a user-facing disclosure that prompts and query terms will leave the local environment. This creates a real privacy and data-governance risk because users may provide sensitive market research, wallet-related context, or proprietary trading interests that are transmitted externally without clear warning or consent.

Vague Triggers

Low

• Confidence: 89% confidence
• Finding: This manifest description says the skill is for "crypto-native Web3 news, flash, and narrative discovery" but does not define when it should activate, what user requests it should match, or any exclusion conditions. In a manifest file, this broad natural-language scope can create ambiguous triggering and overlap with general requests about news or crypto topics.

Static analysis

No suspicious patterns detected.