ClawHub
Back to skill

Security audit

Sardis Balance

Security checks for vulnerabilities and agentic risk

Overview

The skill is read-only and mostly coherent, but it asks to install an unnecessary unpinned npm package while handling financial wallet data and an API key.

Review this before installing if you are not comfortable granting a skill access to Sardis wallet balances, transaction history, vendor spend, and budget data. Prefer installing only after the unnecessary npm dependency is removed or pinned, and use a Sardis API key limited to the wallets and read-only permissions you actually need.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:16
Finding

Unpinned and Unnecessary npm Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16–18
Vulnerability Type: Unpinned third-party dependency and unnecessary supply-chain exposure
Risk Level: Medium

Vulnerable Code:

yaml
install:
  npm:
    - "@sardis/sdk"

Technical Analysis

The skill metadata requests installation of @sardis/sdk without specifying an exact version or package-integrity hash. Consequently, installations may resolve to different package releases over time, including a release published after this audit.

The documented functionality uses curl and jq exclusively; no command in SKILL.md imports or invokes the Sardis SDK. Installing this package therefore adds a third-party execution and dependency surface that is unnecessary for the skill's declared read-only operations.

If the package, its publishing account, or a transitive dependency is compromised, malicious package content or lifecycle scripts could execute during installation. The finding does not establish that the current package is malicious; it identifies an avoidable and insufficiently constrained supply-chain path.

Attack Path

  1. An attacker compromises the package publisher, a transitive dependency, or the package-distribution channel.
  2. The attacker publishes a malicious version that remains compatible with the unconstrained package reference.
  3. A user or automated skill installer installs the skill and resolves @sardis/sdk to the malicious release.
  4. The package manager downloads the attacker-controlled package.
  5. Malicious package code or npm lifecycle scripts execute with the privileges and environment available to the installation process.

Impact Assessment

Successful exploitation could provide arbitrary local code execution under the account installing the skill. Depending on that account's privileges and environment, the attacker could access local files, environment variables—including SARDIS_API_KEY if ...[truncated 215 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove @sardis/sdk from the installation metadata because the documented skill operations do not use it.
  2. If the SDK becomes necessary, pin it to an exact, reviewed version rather than using an unconstrained package reference.
  3. Commit and enforce a lockfile containing integrity hashes for the package and all transitive dependencies.
  4. Verify package provenance and signatures where supported, and use a trusted registry with namespace controls.
  5. Disable npm lifecycle scripts during installation when they are not required, for example through an appropriate ignore-scripts policy.
  6. Run dependency installation in a sandbox with minimal filesystem, network, credential, and environment-variable access.
  7. Add automated dependency auditing and require security review before updating the pinned version.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (12)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md
## API Endpoint Patterns

Base URL: `https://api.sardis.sh/v2`

### Check Wallet Balance

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md
## API Endpoint Patterns

Base URL: `https://api.sardis.sh/v2`

### Check Wallet Balance

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md
## API Endpoint Patterns

Base URL: `https://api.sardis.sh/v2`

### Check Wallet Balance

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

md
## API Endpoint Patterns

Base URL: `https://api.sardis.sh/v2`

### Check Wallet Balance

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md
## API Endpoint Patterns

Base URL: `https://api.sardis.sh/v2`

### Check Wallet Balance

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.

md
## API Endpoint Patterns

Base URL: `https://api.sardis.sh/v2`

### Check Wallet Balance

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.

md
## API Endpoint Patterns

Base URL: `https://api.sardis.sh/v2`

### Check Wallet Balance

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.

md
## API Endpoint Patterns

Base URL: `https://api.sardis.sh/v2`

### Check Wallet Balance

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

md
## API Endpoint Patterns

Base URL: `https://api.sardis.sh/v2`

### Check Wallet Balance

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.

md
## API Endpoint Patterns

Base URL: `https://api.sardis.sh/v2`

### Check Wallet Balance

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

md
## API Endpoint Patterns

Base URL: `https://api.sardis.sh/v2`

### Check Wallet Balance

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 269)May include surrounding context.

md
## API Endpoint Patterns

Base URL: `https://api.sardis.sh/v2`

### Check Wallet Balance

Static analysis

No suspicious patterns detected.