ClawHub
Back to skill

Security audit

Decentralized stop-loss orders for DeFi

Security checks for vulnerabilities and agentic risk

Overview

This instruction-only DeFi trading skill is not clearly malicious, but its stop-loss label understates broader live trading capabilities and its signing/relay guidance needs stronger user control.

Install only if you intend to let an agent help prepare and submit live Spot advanced swap orders, not just stop-losses. Before signing or approving, verify chain ID, token addresses, amounts, deadlines, slippage, and that output.recipient is your intended address; treat agents-sink.orbs.network as a third-party relay receiving signed order data.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (10)

Description-Behavior Mismatch

Medium
Confidence
98% confidence
Finding
The README materially conflicts with the skill metadata by presenting a broad advanced-order DeFi protocol rather than a narrowly scoped stop-loss skill. In an agent/integration context, this can cause capability confusion, overbroad trust, or unintended invocation of functions beyond the user's expected scope, especially where hosted endpoints and generalized order execution are implied.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill instructs agents to submit signed orders to an external relay endpoint, but it does not explicitly require informing the user that order contents and metadata will be transmitted off-platform to a third-party service. In a signing and trading context, users may reasonably assume all processing is local or onchain, so undisclosed relay submission creates privacy, consent, and trust risks even if the payload is not directly custodial.

Description-Behavior Mismatch

Medium
Confidence
98% confidence
Finding
The provided skill manifest says this skill is for decentralized stop-loss orders, but the package metadata identifies it as "spot-skill" and describes support for market, limit, TWAP, take-profit, and delayed-start swaps in addition to stop-loss. That indicates the packaged skill's stated behavior is materially broader than the manifest's narrower stop-loss description.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The documentation tells users to copy and modify signed relay payload shapes and to mix fields, but it does not warn that signatures are bound to exact message contents and that signed order payloads are security-sensitive. In a DeFi trading context, this can lead users or downstream agents to mishandle signatures, misunderstand what may be safely edited, or submit malformed or risky orders that could authorize unintended token movements or failed executions.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The manifest describes the skill as providing decentralized stop-loss orders, but this examples file documents additional order modes: a Limit Order and a TWAP Order alongside Stop-Loss. Those are distinct trading capabilities rather than obvious implementation details of a stop-loss-only skill, so the documented behavior exceeds the stated scope.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The documentation acknowledges that changing `output.recipient` is dangerous, but it does not clearly state that doing so can redirect sale proceeds to an attacker-controlled address and cause direct fund loss. In a DeFi stop-loss skill, this omission is more dangerous than in generic software because the parameter controls where assets are delivered after execution, so weak guidance can lead agents or users to construct harmful orders without realizing the consequence.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The quickstart tells users to sign typed data and submit an order, but it does not clearly warn that these actions can create live on-chain or relay-submitted orders that may move assets or consume approvals. In a DeFi trading skill, omission of transaction-risk warnings increases the chance that users treat the flow as harmless setup rather than authorization for real financial activity.

External Transmission

Medium
Category
Data Exfiltration
Content
'{order: $typed[0].message, signature: $sig, status: "pending"}' \
  > ./relay-payload.json

curl -fsS -X POST 'https://agents-sink.orbs.network/orders/new' \
  -H 'content-type: application/json' \
  --data @./relay-payload.json
```
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
status: "pending",
};

const response = await fetch("https://agents-sink.orbs.network/orders/new", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify(relayPayload),
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Description-Behavior Mismatch

Low
Confidence
88% confidence
Finding
The README advertises additional integrator surfaces and hosted distribution endpoints that go beyond the declared stop-loss purpose of the skill. While not a direct code exploit, this increases attack surface for agent misuse and supply-chain confusion by encouraging consumers to interact with external MCP/hosted resources they may not expect from the manifest alone.

Static analysis

No suspicious patterns detected.