ClawHub
Back to skill

Security audit

Sardis Escrow

Security checks for vulnerabilities and agentic risk

Overview

This escrow skill is purpose-aligned but exposes live funding and release workflows for real-value payments without clear approval gates or safety limits.

Review before installing. Only use this with a tightly scoped Sardis API key, spending limits, known wallet allowlists, and explicit human approval before every fund, release, refund, dispute, milestone, or auto-release setting. Treat the npm dependency as unnecessary unless the publisher pins and justifies it.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:16
Finding

Unpinned and Unused npm Dependency Creates Supply-Chain Exposure

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:16-18
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

yaml
install:
  npm:
    - "@sardis/sdk"

Technical Analysis

The Skill declares automatic installation of @sardis/sdk without an exact version or integrity constraint. The documented workflows use curl and jq; the npm package is not used anywhere in the reviewed file. It therefore expands the trusted computing base without being necessary for the demonstrated functionality.

An unpinned npm dependency may resolve to a newer package release than the one originally reviewed. If the package, its maintainer account, or a transitive dependency is compromised, installation can introduce attacker-controlled code. npm lifecycle scripts may execute during installation with the privileges of the user or service installing the Skill.

No evidence establishes that @sardis/sdk is currently malicious. The confirmed weakness is the unnecessary and unconstrained supply-chain dependency.

Attack Path

  1. An attacker compromises the npm package, its publication credentials, or one of its transitive dependencies.
  2. The attacker publishes a malicious version containing an installation lifecycle script or malicious runtime code.
  3. A user or automated environment installs the Skill.
  4. Because no version is pinned, npm resolves the compromised release.
  5. Package-controlled code executes during installation or becomes available in the local environment.

Impact Assessment

Successful exploitation could execute code with the privileges of the account performing installation. Depending on that account's permissions, this may expose environment variables, local files, API credentials, and other accessible resources. It could also modify files or install additional components within the account's permission scope.

The issue does not itself demonstrate pri ...[truncated 47 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove @sardis/sdk because the documented implementation does not use it.
  2. If the dependency is required, pin it to an audited exact version rather than a floating package reference.
  3. Use a committed lockfile and verify package integrity through the package manager's integrity metadata.
  4. Review the package's source, maintainers, transitive dependencies, and lifecycle scripts before deployment.
  5. Disable npm lifecycle scripts during installation where operationally possible.
  6. Perform dependency installation in an isolated, least-privileged environment without sensitive credentials.
  7. Use automated dependency monitoring and require review before accepting version changes.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:194
Finding

Model-Invocable Workflow Performs Irreversible Financial Operations Without an Enforced Approval Gate

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:20, 194-226
Vulnerability Type: Missing authorization and transaction-confirmation safeguards
Risk Level: High

Vulnerable Code

Model invocation is enabled:

yaml
user-invocable: true
disable-model-invocation: false

The complete workflow proceeds directly from escrow creation to funding and release:

bash
# 1. Create escrow agreement
ESCROW=$(curl -s -X POST https://api.sardis.sh/v2/escrow \
  -H "Authorization: Bearer $SARDIS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "buyer_wallet_id": "wallet_buyer123",
    "seller_wallet_id": "wallet_seller456",
    "amount": "500.00",
    "token": "USDC",
    "chain": "base",
    "description": "Development work"
  }')

ESCROW_ID=$(echo "$ESCROW" | jq -r '.escrow_id')
echo "Created escrow: $ESCROW_ID"

# 2. Buyer funds the escrow
echo "Funding escrow..."
curl -X POST "https://api.sardis.sh/v2/escrow/$ESCROW_ID/fund" \
  -H "Authorization: Bearer $SARDIS_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"escrow_id\": \"$ESCROW_ID\", \"wallet_id\": \"wallet_buyer123\"}"

# 3. Wait for seller delivery (automated)
echo "Waiting for delivery confirmation..."

# 4. Seller confirms delivery
curl -X POST "https://api.sardis.sh/v2/escrow/$ESCROW_ID/confirm-delivery" \
  -H "Authorization: Bearer $SARDIS_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"escrow_id\": \"$ESCROW_ID\", \"wallet_id\": \"wallet_seller456\"}"

# 5. Buyer verifies and releases
echo "Releasing payment to seller..."
curl -X POST "https://api.sardis.sh/v2/escrow/$ESCROW_ID/release" \
  -H "Authorization: Bearer $SARDIS_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{
    \"escrow_id\": \"$ESCROW_ID\",
    \"wallet_id\": \"wallet_buyer123\",
    \"amount\": \"500.00\",
    \"rating\": 5
  }"

echo "Escrow completed!"

Technica

...[truncated 2783 chars]

Remediation
View remediation

Remediation Suggestions

  1. Set disable-model-invocation: true for capabilities that can fund or release assets, or split the Skill into read-only and transaction-changing components.
  2. Require explicit, fresh user approval immediately before every funding, release, refund, or dispute action.
  3. Present a canonical transaction preview containing the escrow ID, recipient, wallet IDs, amount, token, chain, milestone, fees, deadline, and auto-release policy.
  4. Bind approval cryptographically or structurally to the exact transaction parameters so they cannot change after approval.
  5. Query and validate the current escrow state immediately before each mutation.
  6. Require independently validated delivery evidence before enabling release; do not treat seller self-confirmation as sufficient buyer verification.
  7. Maintain separation of duties between buyer and seller actions. Do not demonstrate both roles as one uninterrupted automated sequence.
  8. Enforce spending limits, recipient allowlists, per-transaction limits, and least-privilege API credentials.
  9. Add idempotency keys and verify API responses before proceeding to the next state-changing operation.
  10. Stop execution on malformed responses, missing escrow IDs, authorization failures, state conflicts, or parameter mismatches.
  11. Record an audit log of the displayed transaction, user approval, API request, and resulting transaction hash.
  12. Clearly warn users that funding and release can have irreversible financial consequences.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (21)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.

md
env:
        - SARDIS_API_KEY
      bins:
        - curl
        - jq
    primaryEnv: SARDIS_API_KEY
    emoji: "🔒"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill prominently enables funding and release of escrowed funds, including an auto-release mechanism, but does not provide an explicit warning that payment release may be irreversible or that auto-release can transfer funds without further confirmation after the configured timeout. In an agent-executed context, this increases the chance of accidental authorization of real-value transfers based on incomplete verification.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md
## API Endpoint Patterns

Base URL: `https://api.sardis.sh/v2`

### Create Escrow

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md
## API Endpoint Patterns

Base URL: `https://api.sardis.sh/v2`

### Create Escrow

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

md
## API Endpoint Patterns

Base URL: `https://api.sardis.sh/v2`

### Create Escrow

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

md
## API Endpoint Patterns

Base URL: `https://api.sardis.sh/v2`

### Create Escrow

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.

md
## API Endpoint Patterns

Base URL: `https://api.sardis.sh/v2`

### Create Escrow

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 184)May include surrounding context.

md
## API Endpoint Patterns

Base URL: `https://api.sardis.sh/v2`

### Create Escrow

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 210)May include surrounding context.

md
## API Endpoint Patterns

Base URL: `https://api.sardis.sh/v2`

### Create Escrow

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 237)May include surrounding context.

md
## API Endpoint Patterns

Base URL: `https://api.sardis.sh/v2`

### Create Escrow

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 264)May include surrounding context.

md
## API Endpoint Patterns

Base URL: `https://api.sardis.sh/v2`

### Create Escrow

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 434)May include surrounding context.

md
## API Endpoint Patterns

Base URL: `https://api.sardis.sh/v2`

### Create Escrow

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The fund-escrow endpoint initiates an external action that deposits buyer funds into escrow custody. In this skill context, that is materially risky because executing the example causes real financial commitment and may be irreversible or operationally costly to unwind.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

bash
# Buyer deposits funds into escrow contract
curl -X POST https://api.sardis.sh/v2/escrow/{escrow_id}/fund \
  -H "Authorization: Bearer $SARDIS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

This concrete funding example is directly executable and shows how to move funds into escrow using a live endpoint and bearer token. Because it reduces friction to perform a real financial action, it is dangerous in an agentic setting without mandatory confirmation controls.

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md
}'

# Example:
curl -X POST https://api.sardis.sh/v2/escrow/escrow_xyz789/fund \
  -H "Authorization: Bearer $SARDIS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"escrow_id": "escrow_xyz789", "wallet_id": "wallet_buyer123"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

This release endpoint triggers payout of escrowed funds to the seller and therefore represents a high-risk external action. In a skill intended for autonomous or semi-autonomous use, exposing a ready-to-run release call without strong guardrails can lead to irreversible financial loss if mis-invoked or parameter-tampered.

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

bash
# Buyer releases funds to seller after verification
curl -X POST https://api.sardis.sh/v2/escrow/{escrow_id}/release \
  -H "Authorization: Bearer $SARDIS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The partial-release example is also a payout operation and can transfer real funds milestone by milestone. This expands the attack surface because an agent could be induced to release portions repeatedly or prematurely, causing cumulative financial loss.

Content

Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.

md
}'

# Partial release for milestone:
curl -X POST https://api.sardis.sh/v2/escrow/escrow_xyz789/release \
  -H "Authorization: Bearer $SARDIS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This workflow step funds the escrow and therefore moves assets externally under control of the API-backed system. In a skill document, including this as part of an end-to-end example can normalize or automate risky execution without emphasizing user consent and transactional finality.

Content

Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.

md
# 2. Buyer funds the escrow
echo "Funding escrow..."
curl -X POST "https://api.sardis.sh/v2/escrow/$ESCROW_ID/fund" \
  -H "Authorization: Bearer $SARDIS_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"escrow_id\": \"$ESCROW_ID\", \"wallet_id\": \"wallet_buyer123\"}"

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This workflow step funds the escrow and therefore moves assets externally under control of the API-backed system. In a skill document, including this as part of an end-to-end example can normalize or automate risky execution without emphasizing user consent and transactional finality.

Content

Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.

md
# 2. Buyer funds the escrow
echo "Funding escrow..."
curl -X POST "https://api.sardis.sh/v2/escrow/$ESCROW_ID/fund" \
  -H "Authorization: Bearer $SARDIS_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"escrow_id\": \"$ESCROW_ID\", \"wallet_id\": \"wallet_buyer123\"}"

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This workflow release step directly causes payout to the seller and is therefore a high-risk external transmission. Because the document presents it as a straightforward completion step, an agent or user may execute it reflexively, creating risk of irreversible loss if the delivery was not properly verified or inputs were manipulated.

Content

Scanner excerpt · SKILL.md (reported line 217)May include surrounding context.

md
# 5. Buyer verifies and releases
echo "Releasing payment to seller..."
curl -X POST "https://api.sardis.sh/v2/escrow/$ESCROW_ID/release" \
  -H "Authorization: Bearer $SARDIS_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This milestone release example initiates a real payout of part of the escrow balance to the seller. Even partial transfers can be difficult to recover, and repeated milestone releases can be abused or triggered prematurely in an autonomous execution context.

Content

Scanner excerpt · SKILL.md (reported line 276)May include surrounding context.

md
ESCROW_ID=escrow_xyz789

# Release milestone 1
curl -X POST "https://api.sardis.sh/v2/escrow/$ESCROW_ID/release" \
  -H "Authorization: Bearer $SARDIS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This milestone release example initiates a real payout of part of the escrow balance to the seller. Even partial transfers can be difficult to recover, and repeated milestone releases can be abused or triggered prematurely in an autonomous execution context.

Content

Scanner excerpt · SKILL.md (reported line 276)May include surrounding context.

md
ESCROW_ID=escrow_xyz789

# Release milestone 1
curl -X POST "https://api.sardis.sh/v2/escrow/$ESCROW_ID/release" \
  -H "Authorization: Bearer $SARDIS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Static analysis

No suspicious patterns detected.