ClawHub
Back to skill

Security audit

Settlement Predictor

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed blockchain fee and transaction-analysis tool, with some privacy and dependency cautions but no evidence of hidden, destructive, or deceptive behavior.

Install this only if you are comfortable sending blockchain addresses, transaction hashes, and optional simulation details to public RPC/explorer services and Tenderly. Use a dedicated low-privilege Etherscan/Tenderly API key, consider pinning dependencies in an isolated virtual environment, and delete ~/.cache/settlement-predictor if you do not want local gas/fee history retained.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
requirements.txt:4
Finding

Unbounded Third-Party Dependency Version

Content
View full analysis

Vulnerability Details

File Location: requirements.txt:4
Vulnerability Type: Unbounded dependency version and missing integrity verification
Risk Level: Medium

Vulnerable Code

text
web3>=6.0.0

The installation instructions repeat this unconstrained dependency specification in SKILL.md:160-163 and SKILL.md:301-304.

Technical Analysis

The project accepts any current or future web3 version greater than or equal to 6.0.0. It does not provide an upper version boundary, lockfile, or package integrity hashes. Consequently, the exact code installed cannot be determined from the audited project.

Python package installation can execute package build logic with the privileges of the user running pip. Moreover, imported dependency code executes with the same filesystem, environment, and network access as the Skill. The broad constraint also allows future incompatible releases to be selected automatically.

The implementation directly imports requests, but requests is not explicitly declared in requirements.txt; its availability currently depends on the transitive dependency graph. This weakens dependency reproducibility further.

Attack Path

  1. An attacker compromises a permitted future release of web3 or one of its transitive dependencies.
  2. The compromised version continues to satisfy web3>=6.0.0.
  3. A user follows the documented installation process and runs pip install -r requirements.txt.
  4. The package manager resolves and installs the compromised version because no reviewed version or hash is enforced.
  5. Malicious installation or import-time code executes with the installing or invoking user's privileges.

This path depends on an upstream supply-chain compromise; no malicious dependency payload was found in the audited project itself.

Impact Assessment

A compromised dependency would execute with the same privileges as the user installing or running th ...[truncated 295 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin web3 and all direct dependencies to specifically reviewed versions.
  2. Declare requests explicitly rather than relying on transitive installation.
  3. Generate and commit a reproducible lockfile containing the complete transitive dependency graph.
  4. Require package hashes during deployment, for example through a hash-locked requirements file and pip install --require-hashes.
  5. Use an automated dependency scanner and a controlled process for reviewing and updating pinned versions.
  6. Install dependencies in an isolated virtual environment under a non-privileged account.

T09 · Insecure Skill Coding Practices

Note
Location
settlement_predictor.py:1337
Finding

Etherscan API Key Exposed in URL Query Parameters

Content
View full analysis

Vulnerability Details

File Location: settlement_predictor.py:1337-1343
Additional Locations: settlement_predictor.py:1365-1371, 1460-1470, and 1519-1526
Vulnerability Type: Sensitive credential placed in URL query parameters
Risk Level: Low

Vulnerable Code

python
params = {
    "module": "contract",
    "action": "getsourcecode",
    "address": address,
    "apikey": api_key,
}
data = _http_get(explorer_base, params)

The helper passes these parameters to requests.get:

python
def _http_get(url: str, params: Optional[Dict] = None, timeout: int = 10) -> Optional[Dict]:
    try:
        r = requests.get(url, params=params, timeout=timeout, headers={
            "Accept": "application/json",
            "User-Agent": "settlement-predictor/1.0"
        })
        r.raise_for_status()
        return r.json()
    except Exception:
        return None

Technical Analysis

ETHERSCAN_API_KEY is read from the environment and inserted into the HTTP query string. The destinations are fixed, documented Etherscan-family HTTPS endpoints rather than attacker-controlled URLs, so this behavior is functionally related to contract verification, token lookup, and internal-transaction retrieval. No covert exfiltration or dynamic destination was identified.

Nevertheless, credentials in query strings may be retained in reverse-proxy logs, HTTP diagnostics, monitoring platforms, debugging output, or prepared-request telemetry. HTTPS protects the request in transit but does not prevent either endpoint-side URL logging or logging by trusted local components that can observe the request before encryption.

Tenderly handling does not exhibit this specific weakness: settlement_predictor.py:1819-1834 sends TENDERLY_API_KEY in the X-Access-Key header to the fixed Tenderly HTTPS API.

Attack Path

  1. A user configures ETHERSCAN_API_KEY in the environment.

...[truncated 1112 chars]

Remediation
View remediation

Remediation Suggestions

  1. Use an authorization header instead of a query parameter wherever the explorer API supports it.
  2. If the provider requires a query parameter, ensure application, proxy, telemetry, and error-reporting configurations redact the apikey parameter.
  3. Never log prepared request URLs without credential filtering.
  4. Use restricted, low-privilege API keys and rotate any key suspected of appearing in logs.
  5. Document that the optional credential is transmitted to the selected Etherscan-family service.
  6. Consider centralizing authenticated explorer requests in a helper that enforces endpoint allowlisting and secret redaction.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (34)

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared purpose emphasizes settlement prediction and fee analytics, but the documented behavior expands into contract verification, token lookup, internal transaction retrieval, and transaction simulation. This scope mismatch can mislead users and policy engines about what the skill actually does, which is dangerous when extra behaviors involve additional data collection, third-party transmission, or higher-risk blockchain interactions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Most section headings, parameter descriptions, and usage guidance are written only in Chinese, while the file does not state that the skill is intended exclusively for a Chinese-speaking or region-specific audience. This creates a language-policy issue because users are not given an opt-in or alternative language path.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The README advertises contract verification, token lookup, and internal transaction tracing that expand the skill beyond its stated settlement-prediction purpose. Scope expansion increases attack surface and may cause an agent or user to invoke higher-risk blockchain inspection features that were not justified by the manifest, weakening least-privilege and trust expectations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Contract verification and security scanning are materially different from fee prediction and settlement estimation, and they imply analysis of arbitrary third-party contracts. In an agent setting, undocumented security-scanning functionality can be abused to broaden tool usage, access extra external services, or induce trust in results outside the skill’s declared scope.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The manifest declares no explicit tool scope even though the skill clearly uses environment variables and external network access. In an agent platform, missing scope declarations can cause users and orchestrators to underestimate what the skill can read or transmit, increasing the chance of unintended data exposure or overbroad execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Several triggers such as general gas/fee trend phrases are broad enough to activate during ordinary crypto discussion rather than an intentional tool invocation. Over-broad triggers can cause accidental network calls, external data sharing, or agent actions on unrelated conversations, which is especially risky for a skill that performs third-party queries and transaction-related analysis.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill documents transaction tracking, mempool analysis, and third-party API usage without clearly warning that addresses, transaction hashes, pool addresses, and related query data may be sent to external services such as Etherscan, Tenderly, or mempool.space. This creates a privacy and operational-security risk because blockchain query metadata can reveal user interests, pending activity, counterparties, or intended transactions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Documented scope creep into contract verification and security risk scanning goes beyond the manifest's stated analytics purpose. In agent ecosystems, such under-disclosure can bypass user expectations and safety review boundaries, especially because security scanning often queries external services and may influence sensitive decisions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Transaction simulation via Tenderly or local eth_call is a materially different capability from simple fee analytics and can transmit user-supplied transaction details to third parties. Omitting this from the manifest weakens informed consent and can lead to unanticipated exposure of addresses, calldata, counterparties, or intended actions.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · settlement_predictor.py (reported line 71)May include surrounding context.

python
# Etherscan-style base URLs (for optional API calls)
ETHERSCAN_BASE: Dict[str, str] = {
    "ethereum":   "https://api.etherscan.io/api",
    "arbitrum":   "https://api.arbiscan.io/api",
    "optimism":   "https://api-optimistic.etherscan.io/api",
    "base":       "https://api.basescan.org/api",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · settlement_predictor.py (reported line 72)May include surrounding context.

python
# Etherscan-style base URLs (for optional API calls)
ETHERSCAN_BASE: Dict[str, str] = {
    "ethereum":   "https://api.etherscan.io/api",
    "arbitrum":   "https://api.arbiscan.io/api",
    "optimism":   "https://api-optimistic.etherscan.io/api",
    "base":       "https://api.basescan.org/api",
    "polygon":    "https://api.polygonscan.com/api",

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · settlement_predictor.py (reported line 74)May include surrounding context.

python
"ethereum":   "https://api.etherscan.io/api",
    "arbitrum":   "https://api.arbiscan.io/api",
    "optimism":   "https://api-optimistic.etherscan.io/api",
    "base":       "https://api.basescan.org/api",
    "polygon":    "https://api.polygonscan.com/api",
}

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · settlement_predictor.py (reported line 75)May include surrounding context.

python
"arbitrum":   "https://api.arbiscan.io/api",
    "optimism":   "https://api-optimistic.etherscan.io/api",
    "base":       "https://api.basescan.org/api",
    "polygon":    "https://api.polygonscan.com/api",
}

BTC_RELAY = "https://mempool.space/api"

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · settlement_predictor.py (reported line 476)May include surrounding context.

python
def _post_json(url: str, data: Dict, timeout: int = 10) -> Optional[Dict]:
    try:
        r = requests.post(url, json=data, timeout=timeout, headers={
            "Accept": "application/json",
            "User-Agent": "settlement-predictor/1.0"
        })

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The code reads ETHERSCAN_API_KEY and TENDERLY_API_KEY from the environment to enable features outside the core settlement-prediction use case. This is risky because users or hosts may expose privileged credentials to a skill whose primary purpose does not clearly require them, increasing the blast radius if the feature set is abused or misunderstood.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · settlement_predictor.py (reported line 1179)May include surrounding context.

python
pass
    try:
        r = requests.get(
            "https://api.coingecko.com/api/v3/simple/price",
            params={"ids": "ethereum", "vs_currencies": "usd"},
            timeout=5,
        )

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill’s advertised purpose is settlement/gas prediction, but it also implements contract verification, token inspection, internal transaction retrieval, and transaction simulation. That scope expansion increases attack surface and can cause users to disclose addresses, transaction hashes, and intent to third-party services without expecting those operations from this skill’s stated role.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Contract verification sends user-supplied contract addresses and chain selection to Etherscan-style APIs, but the skill does not provide strong user-facing disclosure at execution time. Blockchain addresses and lookup intent can still be sensitive metadata, especially in enterprise, research, or pre-disclosure contexts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

Token lookup uses public RPC endpoints and may additionally query explorer APIs with a user-provided token address, without clearly surfacing that the address is being sent off-host. This can leak user research targets, wallet investigation context, or proprietary monitoring activity to third parties.

Content

No source excerpt is available for this finding.