ClawHub
Back to skill

Security audit

Deploy Spark Bitcoin L2 Proxy

Security checks for vulnerabilities and agentic risk

Overview

This is a real deployment guide, but it asks an agent to handle wallet recovery words and deployment secrets and uses mutable deployment tooling, so it needs careful review before installation.

Install only after reviewing the upstream proxy and deployment flow. Do not paste wallet mnemonics, Vercel tokens, Upstash keys, or bearer tokens into chat; enter secrets directly in a local terminal or provider dashboard. Use a fresh low-value wallet, production-only secret scope unless separately justified, pinned repository and CLI versions, conservative spending caps, domain allowlists for L402, and a clear process for rotating or disabling the admin fallback token.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:22
Finding

Excessive Collection and Environment Exposure of Wallet Credentials

Content
View full analysis
/env?teamId=" \ -H "Authorization: Bearer " \ -H "Content-Type: application/json" \ -d '{"type":"encrypted","key":"SPARK_MNEMONIC","value":"your mnemonic here","target":["production","preview","development"]}' ``` ### Technical Analysis The Skill tells the agent to request a BIP39 recovery mnemonic and infrastructure credentials directly from the user. A wallet mnemonic is a root secret that provides control over all wallet keys and funds. The agent does not need to receive or process this secret to explain or coordinate deployment; the user can enter it directly into Vercel's protected secret-management interface. The documented Vercel API request legitimately sends the mnemonic to Vercel for deployment and does not constitute evidence of covert exfiltration. However, it assigns the secret to `production`, `preview`, and `development`. Only production access is necessary for the declared production deployment workflow. Preview and development environments may involve less-reviewed code, additional collaborators, temporary deployments, or weaker operational controls. Requesting these credentials in an agent conversation also creates unnecessary exposure through chat history, telemetry, debugging records, copied transcripts, or other components involved in processing the session. ### Attack Path ...[truncated 1353 chars]
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Warning
Location
SKILL.md:36
Finding

Mutable and Unverified Third-Party Code Execution During Deployment

Content
View full analysis
Remediation
View remediation
`, and include it in the lockfile where practical. - Use npm provenance, integrity metadata, signed releases, or documented checksums where available. - Run installation and deployment from an isolated environment with only the minimum credentials required for the target project. - Keep wallet mnemonics unavailable to local dependency installation processes. - Add automated dependency auditing and upstream-change review before updating pinned versions. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:163
Finding

Non-Revocable Administrative Fallback Token Weakens Access Control

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (10)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill asks the user up front for extremely sensitive material, including an Upstash API key and a BIP39 wallet mnemonic, without a prominent warning not to paste secrets into chat or to prefer secure local entry. In this context the mnemonic controls funds, so encouraging disclosure through an agent workflow materially increases the risk of credential theft and wallet compromise.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

Otherwise, create a database via the Upstash API. The user needs their Upstash email and API key from https://console.upstash.com/account/api:

bash
curl -X POST "https://api.upstash.com/v2/redis/database" \
  -u "UPSTASH_EMAIL:UPSTASH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "sparkbtcbot-proxy", "region": "global", "primary_region": "us-east-1"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

Otherwise, create a database via the Upstash API. The user needs their Upstash email and API key from https://console.upstash.com/account/api:

bash
curl -X POST "https://api.upstash.com/v2/redis/database" \
  -u "UPSTASH_EMAIL:UPSTASH_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"name": "sparkbtcbot-proxy", "region": "global", "primary_region": "us-east-1"}'

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

Using npx vercel --prod without pinning a specific package version causes the latest CLI to be fetched and executed at runtime, creating a supply-chain risk and reducing deployment reproducibility. In a deployment skill that handles wallet mnemonics, auth tokens, and infrastructure secrets, compromise of the fetched CLI could expose credentials or alter deployment behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

Important: Do NOT use vercel env add with heredoc/<<< input — it appends newlines that break the Spark SDK. Either use the Vercel dashboard or the REST API:

bash
curl -X POST "https://api.vercel.com/v10/projects/<PROJECT_ID>/env?teamId=<TEAM_ID>" \
  -H "Authorization: Bearer <VERCEL_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"type":"encrypted","key":"SPARK_MNEMONIC","value":"your mnemonic here","target":["production","preview","development"]}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

Important: Do NOT use vercel env add with heredoc/<<< input — it appends newlines that break the Spark SDK. Either use the Vercel dashboard or the REST API:

bash
curl -X POST "https://api.vercel.com/v10/projects/<PROJECT_ID>/env?teamId=<TEAM_ID>" \
  -H "Authorization: Bearer <VERCEL_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"type":"encrypted","key":"SPARK_MNEMONIC","value":"your mnemonic here","target":["production","preview","development"]}'

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

This is a second instance of executing the unpinned vercel package through npx, which may download and run whatever version is current at execution time. Because this step occurs after secrets are configured, a malicious or compromised package could access deployment credentials or environment values.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

Create an invoice-only token for a merchant bot:

bash
curl -X POST -H "Authorization: Bearer <admin-token>" \
  -H "Content-Type: application/json" \
  -d '{"role": "invoice", "label": "merchant-bot"}' \
  https://<deployment>/api/tokens

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The L402 section explains automatic payment of Lightning invoices for arbitrary URLs but does not foreground that this can spend real funds on external resources. In an agent-facing deployment skill, this is especially dangerous because users may enable behavior that allows automated spending and content fetching without appreciating the financial consequences.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

Repeating the unpinned npx vercel --prod pattern in operational guidance normalizes unsafe execution of an unversioned remote package. That creates avoidable supply-chain exposure during token rotation and redeployment workflows tied to sensitive wallet infrastructure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.