ClawHub
Back to skill

Security audit

Clap Trader

Security checks for vulnerabilities and agentic risk

Overview

This skill is openly a Binance trading tool, but it gives an agent real-money trading authority with weak guardrails.

Install only if you are comfortable giving an agent the ability to use Binance API credentials and place trades. Use a restricted Binance key with withdrawals disabled, keep dry-run as the normal mode, review every order manually, and add symbol, order-size, and loss limits before live use.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/sentiment_data.py:15
Finding

Untrusted RSS Content Can Influence Real-Money Trading Decisions

Content
View full analysis

Vulnerability Details

File Location: scripts/sentiment_data.py:15-29, scripts/sentiment_data.py:49-60, and SKILL.md:37-62
Vulnerability Type: Indirect prompt injection through untrusted external content
Risk Level: High

Vulnerable code:

python
response = requests.get(feed_url, timeout=10)
if response.status_code == 200:
    root = ET.fromstring(response.content)
    count = 0
    for item in root.findall('.//item'):
        if count >= limit:
            break

        title = item.find('title').text if item.find('title') is not None else "No Title"
        description = item.find('description').text if item.find('description') is not None else ""

        news_items.append({
            "source": feed_url,
            "title": title,
            "description": description[:200] + "..." if len(description) > 200 else description
        })
python
for news in all_news:
    sentiment = analyze_sentiment(news['title'] + " " + news['description'])
    sentiment_label = "NEUTRAL"
    if sentiment > 0.1:
        sentiment_label = "POSITIVE"
    elif sentiment < -0.1:
        sentiment_label = "NEGATIVE"

    processed_news.append({
        "title": news['title'],
        "sentiment_score": round(sentiment, 2),
        "sentiment_label": sentiment_label
    })

The associated workflow instructs the Agent to use this output when deciding whether to place a trade:

markdown
**Sentiment Analysis**
Run the sentiment script to fetch latest news headers and forum buzz.
```bash
python skills/crypto_trader/scripts/sentiment_data.py

2. Decision Making & Logging

Analyze & Record Based on the outputs from step 1, form a hypothesis. Is the market Bullish, Bearish, or Neutral?

3. Execution

Trade If the analysis supports a trade, execute it.

text

### Technical Analysis

RSS titles and descriptions are remo
...[truncated 1840 chars]
Remediation
View remediation

Remediation Suggestions

  1. Treat every RSS field as untrusted data and explicitly instruct the Agent never to follow commands or recommendations contained in fetched content.
  2. Place feed content in a rigid structured-data boundary and label fields as quotations from external sources.
  3. Use a deterministic preprocessing layer to reject or flag instruction-like content before presenting it to the Agent.
  4. Do not allow news text alone to trigger a trade. Use independently validated numerical signals and predefined trading rules.
  5. Require explicit human confirmation for every real-money order, displaying the symbol, side, order type, quantity, estimated value, and decision rationale.
  6. Enforce maximum order values, daily loss limits, symbol allowlists, position limits, and cooldown periods in trade.py.
  7. Use a Binance API key restricted to trading only, disable withdrawal permission, and apply an IP allowlist where supported.
  8. Keep dry-run mode as the default and require a separate explicit flag for live trading.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:12
Finding

Unpinned Third-Party Dependencies Create a Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:12-15
Vulnerability Type: Unpinned dependency installation
Risk Level: Medium

Vulnerable installation instruction:

markdown
## Dependencies

Ensure the following Python packages are installed:
```bash
pip install ccxt pandas pandas-ta requests TextBlob
text

### Technical Analysis

The installation command does not specify exact package versions, cryptographic hashes, or a reviewed lock file. Package resolution therefore depends on the versions available from the configured Python package index at installation time.

This makes builds non-reproducible and permits a compromised maintainer account, malicious future release, altered transitive dependency, or compromised package repository to change the code installed without any corresponding modification to the audited Skill. Python packages can execute code during installation and later when imported. The affected dependencies are imported by scripts that may run in an environment containing Binance API credentials.

The audit found no evidence that the currently named packages are intentionally malicious or typosquatted. The vulnerability is the unsafe, unconstrained dependency acquisition process.

### Attack Path

1. An attacker compromises a direct or transitive dependency, its maintainer account, or the configured package distribution channel.
2. The attacker publishes a malicious package release that still satisfies the unconstrained installation command.
3. A user follows the documented `pip install` instruction.
4. The package resolver selects and installs the compromised release.
5. Malicious code executes during installation or when one of the Skill scripts imports the package.
6. The code operates with the current user's privileges and may access environment variables, local Skill files, network resources, or trading credentials available to the process.

### Impact Assessment

Exp
...[truncated 412 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the free-form installation command with a reviewed lock file containing exact direct and transitive dependency versions.
  2. Record cryptographic hashes for every distribution and install with pip install --require-hashes -r requirements.txt.
  3. Install dependencies in an isolated virtual environment or container rather than the host Python environment.
  4. Use a trusted package index and prevent unexpected fallback to public or unapproved indexes.
  5. Review dependency provenance and monitor packages for known vulnerabilities and ownership changes.
  6. Regenerate and review the lock file through a controlled update process rather than automatically accepting the newest releases.
  7. Run the Skill under a dedicated, least-privileged account with access only to required files and narrowly scoped Binance credentials.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill claims ETH-specific trading and market research, but reported behavior indicates broader symbol trading, use of Binance credentials, and file logging without declared permissions. This combination is risky because operators may believe they are enabling a narrow, reviewed capability when the actual operational surface is wider and includes secret use and persistent side effects.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The skill claims ETH-specific trading and market research, but reported behavior indicates broader symbol trading, use of Binance credentials, and file logging without declared permissions. This combination is risky because operators may believe they are enabling a narrow, reviewed capability when the actual operational surface is wider and includes secret use and persistent side effects.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill claims ETH-specific trading and market research, but reported behavior indicates broader symbol trading, use of Binance credentials, and file logging without declared permissions. This combination is risky because operators may believe they are enabling a narrow, reviewed capability when the actual operational surface is wider and includes secret use and persistent side effects.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill claims ETH-specific trading and market research, but reported behavior indicates broader symbol trading, use of Binance credentials, and file logging without declared permissions. This combination is risky because operators may believe they are enabling a narrow, reviewed capability when the actual operational surface is wider and includes secret use and persistent side effects.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill instructs use of sensitive environment variables, network access, and local file writes, yet declares no explicit tool scope or permission boundaries. In an agent setting, this increases the chance of over-broad execution and unintended access to secrets, external services, or persistent files without clear user consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.