FeedOracle Compliance Intelligence

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 6:46 PM UTC
• Version: 1.2.3

Overview

This skill is a disclosed compliance-data connector that sends limited, user-requested queries to FeedOracle and does not include local executable code or hidden persistence.

Install only if you are comfortable sending stablecoin symbols or explicit compliance questions to feedoracle.io. Avoid including PII or unrelated conversation context, use audit logging and KYA registration only when you intend the remote service to retain that data, and prefer a pinned installer version instead of an @latest command when available.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:178

Finding

Unpinned Third-Party Package Execution via npx

Content

View full analysis

Vulnerability Details

File Location: README.md:178
Vulnerability Type: Insecure dependency installation using a mutable package tag
Risk Level: Medium

Vulnerable Code

bash

npx clawhub@latest install feedoracle-compliance

Technical Analysis

The documented installation command instructs npx to retrieve and execute the latest release of the third-party clawhub package. The latest tag is mutable, so the code executed by this command can change after this Skill has been reviewed. The project does not include a package lockfile, integrity hash, signature-verification procedure, or local copy of that package through which the executed version can be independently audited.

This is a supply-chain weakness rather than evidence that the current package is malicious. Exploitation would require compromise of the package, its publisher account, or its distribution channel, or publication of an unexpectedly unsafe release under the mutable tag.

Attack Path

1. An attacker compromises the package publisher account, package registry, or release process associated with clawhub.
2. The attacker publishes a malicious release and assigns it to the mutable latest tag.
3. A user follows the installation instructions and runs the documented npx command.
4. npx downloads and executes the attacker-controlled package code.
5. The malicious package operates with the permissions of the user who launched the command and can access resources available to that account.

Impact Assessment

Successful exploitation could result in arbitrary code execution under the installing user's privileges. Depending on the user's environment and permissions, the malicious package could read or alter user-accessible files, access environment variables and credentials available to the process, modify local configuration, make network requests, or install additional components. The scope is normally limited to the ...[truncated 125 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the mutable @latest tag with an exact, reviewed package version.
• Publish the expected package version and integrity digest alongside the installation instructions.
• Where supported, require registry provenance or publisher-signature verification before installation.
• Document how users can inspect the package and verify its checksum before execution.
• Recommend running installation without elevated privileges and within a restricted or disposable environment.
• Establish a controlled update process in which new versions are reviewed before the pinned version is changed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: feedoracle-compliance
description: "MiCA compliance evidence and stablecoin risk scoring for regulated tokenized markets. 27 MCP tools with ES256K-signed responses. Use when the user explicitly asks about stablecoin compliance, MiCA regulatory status, or needs verifiable evidence for audit workflows."
version: 1.2.2
metadata:
  openclaw:
    requires:
      bins:
        - curl
    emoji: "🛡️"
    homepage: https://feedoracle.io
---

# FeedOracle Compliance Intelligence

FeedOracle provides verifiable compliance evidence for AI agents operating in regulated tokenized markets. Every response is ES256K-signed (J

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

md

Includes: `compliance_preflight`, `mica_status`, `mica_full_pack`, `mica_market_overview`, `peg_deviation`, `peg_history`, `significant_issuer`, `interest_check`, `document_compliance`, `reserve_quality`, `rlusd_integrity`, `evidence_profile`, `evidence_leaderboard`, `evidence_bundle`, `custody_risk`, `market_liquidity`, `macro_risk`, `ai_explain`, `ai_provenance`, `kya_status`, `audit_query`, `audit_verify`, `ping`, `generate_report`

**ai_query — sends question text (user-initiated only):**
This tool sends the user's natural language question to feedoracle.io for routing to the correct evidence API. **Only invoke when the user explicitly asks a compliance question.** Do not send conversation history, PII, or unrelated text.

| Sent | NOT sent |
|------|----------|

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 46)May include surrounding context.

bash

# MiCA compliance check (no auth needed)
curl -s -X POST https://feedoracle.io/mcp \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"test","version":"1.0"}}}'

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The README instructs users to run npx clawhub@latest install, which pulls and executes the latest published package code at install time without pinning a trusted version. If the upstream package is compromised or a malicious update is published, users and agents could execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.