ClawHub
Back to skill

Security audit

Automated crypto take-profit orders

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real crypto order helper, but it exposes broader and sensitive trading actions than its take-profit label implies.

Review before installing. Use this only if you want a general Spot advanced EVM swap-order skill, not merely take-profit orders. Before signing or submitting anything, verify the chain, token addresses, amounts, recipient, spender/verifying contract, deadlines, trigger fields, and relay URL, and prefer exact approvals over standing maxUint approvals.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (13)

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The README presents this package as a broad advanced-order DeFi protocol supporting market, limit, TWAP, stop-loss, take-profit, delayed-start orders, hosted MCP endpoints, and operational components, while the skill metadata frames it narrowly as a take-profit skill. That mismatch can mislead users or agents about the actual accessible capability surface, causing them to invoke or trust broader functionality than intended for the declared skill scope.

Context-Inappropriate Capability

Medium
Confidence
91% confidence
Finding
Describing a Refinery component that can batch multicalls and sweep token balances expands the apparent operational power well beyond a narrowly described take-profit skill. In an agent context, broadly scoped operational primitives like multicall batching and token sweeping are dangerous because they may enable fund movement or administrative actions that a user would not reasonably expect from the declared skill purpose.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs the agent to submit signed orders to an external relay endpoint but does not prominently warn that user-generated signed payloads will be transmitted to a third-party service. Even if the payload is non-custodial, users should be explicitly informed because signatures, order details, wallet metadata, and trading intent are sensitive and can create privacy, replay, or misuse risks if sent unexpectedly.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The provided manifest context says the skill is for 'Automated crypto take-profit orders,' implying a focused purpose. However, package.json describes the code/package as supporting 'market, limit, TWAP, stop-loss, take-profit, delayed-start swaps,' which is materially broader than take-profit only.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The file encourages copying a nearby relay payload shape and replacing fields, but it does not prominently warn that every field in the signing payload must be independently verified before signing or relaying. Because these are crypto order payloads with spender, executor, token, amount, chainid, recipient, and exchange fields, users or agents may reuse a structurally valid but unsafe payload and authorize unintended asset movement or execution conditions.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The examples include Stop-Loss and TWAP payloads even though the skill is described as a take-profit skill. In an agent context, examples strongly influence generated payloads, so this scope mismatch can cause the agent or user to create and sign materially different order types than intended, increasing the chance of unintended trades or losses.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
This is a markdown file, so SQP-2 applies to missing safety warnings in the skill description. Line L18 hints at danger, but it does not provide a clear user-facing warning about the consequences for user funds or advise verification before use.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The manifest presents this skill as specifically for automated crypto take-profit orders. However, the quickstart instructs users to create market, limit, stop-loss, delayed-start, and chunked/TWAP orders, indicating materially broader functionality than the stated purpose.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill explicitly instructs the user to transmit a signed order payload, including wallet-derived signature material and order contents, to an external relay service, but it does not clearly warn that this data is leaving the local environment or explain the trust boundary. In a signing workflow, omission of that warning is security-relevant because users may treat the relay as part of their wallet flow and submit sensitive authorization data without understanding the off-system exposure.

External Transmission

Medium
Category
Data Exfiltration
Content
'{order: $typed[0].message, signature: $sig, status: "pending"}' \
  > ./relay-payload.json

curl -fsS -X POST 'https://agents-sink.orbs.network/orders/new' \
  -H 'content-type: application/json' \
  --data @./relay-payload.json
```
Confidence
88% confidence
Finding
The curl example posts a relay payload containing order data and signature material to an external endpoint, again establishing off-system transmission of wallet-authorized data. In the context of crypto order signing, this is inherently sensitive because the signed payload may enable order creation or replay within system rules, and the documentation does not adequately emphasize that trust decision.

External Transmission

Medium
Category
Data Exfiltration
Content
status: "pending",
};

const response = await fetch("https://agents-sink.orbs.network/orders/new", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify(relayPayload),
Confidence
88% confidence
Finding
This code sends the signed order payload to an external HTTPS endpoint using fetch, which creates an external data exfiltration path for wallet-derived authorization data. Although submission to a relay is part of the product flow, the skill does not pair this with a clear consent/trust warning or guidance on validating the remote endpoint, so the user may unknowingly disclose reusable signed material to an external service.

Intent-Code Divergence

Low
Confidence
90% confidence
Finding
The README mixes a narrow manifest identity with broad protocol-level documentation, creating ambiguity about what the skill actually does. In security-sensitive agent ecosystems, capability ambiguity is itself risky because users and orchestration systems may grant trust, permissions, or autonomy based on an incomplete understanding of the skill's real scope.

Description-Behavior Mismatch

Low
Confidence
73% confidence
Finding
The manifest makes a precise supported-chain claim, while this file only says the protocol supports multiple EVM chains and points to config.json as the canonical source. In this file, the specific '8 chains' claim is not substantiated, creating a documentation-level mismatch with the manifest's concrete scope statement.

Static analysis

No suspicious patterns detected.