ClawHub
Back to skill

Security audit

Haggle Protocol

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent and disclosed, but it asks agents to use a raw wallet private key with external npm code that can move real funds.

Review this before installing. Use only a dedicated wallet with minimal funds and exact token approvals, test on testnets first, and avoid running the global npm install or npx package with a valuable private key unless you independently trust or verify the published package and its dependencies.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
scripts/setup.sh:7
Finding

Unverified Third-Party npm Package Executes with Access to a Wallet Private Key

Content
View full analysis

Vulnerability Details

File Location: scripts/setup.sh:7-8 (related execution instruction at scripts/setup.sh:27; additional package instructions at SKILL.md:49-69)
Vulnerability Type: Third-party supply-chain exposure without local source or integrity verification
Risk Level: High

Vulnerable code:

bash
echo "Installing Haggle Protocol MCP Server v0.2.0..."
npm install -g @haggle-protocol/mcp@0.2.0

The installed package is subsequently executed as follows:

bash
echo "Run: npx @haggle-protocol/mcp@0.2.0"

The Skill documentation also directs users to install or execute additional externally hosted packages:

bash
npm install -g @haggle-protocol/mcp@0.2.0
bash
npx @haggle-protocol/mcp@0.2.0
bash
npm install @haggle-protocol/evm@0.1.0    # For Base/Monad/Arbitrum
npm install @haggle-protocol/solana@0.1.0  # For Solana
npm install @haggle-protocol/core@0.1.0    # Shared types
bash
npx @haggle-protocol/api@0.1.0

Technical Analysis

The setup script globally installs an npm package whose implementation is not included in the audited project. npm installation may execute package lifecycle scripts, while global installation permits the package to modify the global npm installation area and expose executable commands on the host. The package is then executed through npx in an environment that may contain HAGGLE_PRIVATE_KEY.

Exact package versions are specified, which reduces uncontrolled version drift, but the project provides no lockfile, verified package digest, signed provenance, vendored source, or other mechanism to validate the installed artifact. Consequently, claims in SKILL.md that the private key is never transmitted and that no telemetry exists cannot be verified from the supplied files.

The local shell script does not print or transmit the private key itself. The vulnerability arises from granting unaudited extern ...[truncated 1897 chars]

Remediation
View remediation

Remediation Suggestions

  1. Vendor and audit the exact MCP package and all transitive dependencies, or include their reviewed source in the distributed Skill.
  2. Use a project-local installation with a committed lockfile instead of npm install -g and avoid npx fetching or resolving code at runtime.
  3. Pin and verify package integrity using trusted cryptographic digests, signed release artifacts, and npm provenance attestations. Validate the resolved tarball before installation.
  4. Disable npm lifecycle scripts where compatible, such as with npm install --ignore-scripts, and explicitly review any lifecycle script that is operationally required.
  5. Execute the package inside a sandbox or isolated container under an unprivileged account, with a minimal filesystem view and outbound network access restricted to documented blockchain RPC endpoints.
  6. Do not expose a raw private key to a general-purpose dependency process. Prefer a policy-controlled signer, hardware-backed key, delegated session key, or wallet service that enforces destination, contract, chain, amount, and spending limits.
  7. Use a dedicated wallet containing only the minimum required funds. Grant exact token allowances, revoke allowances after use, and monitor the wallet for unexpected transactions.
  8. Document the verified package hash and dependency tree so operators can reproduce and independently validate the reviewed build.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.