ClawHub
Back to skill

Security audit

Find Arbitrage Opps

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but its setup and API credential handling are broad enough that users should review it before installing.

Install only if you are comfortable reviewing or replacing the prerequisite command and running the scanner against a trusted local Hummingbot API. Avoid running the curl-to-bash setup as-is, set explicit non-default API credentials, keep HUMMINGBOT_API_URL on localhost or HTTPS, and make sure no unintended .env file can control the API target.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:17
Finding

Unpinned Remote Shell Script Download and Execution

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/find_arb_opps.py:48
Finding

Basic Authentication Credentials Can Be Sent over Plaintext HTTP

Content
View full analysis
dict: """Make authenticated API request.""" config = get_api_config() url = f"{config['url']}{endpoint}" credentials = base64.b64encode(f"{config['user']}:{config['password']}".encode()).decode() headers = { "Authorization": f"Basic {credentials}", "Content-Type": "application/json", } ``` ### Technical Analysis The code constructs an HTTP Basic Authentication header by Base64-encoding the API username and password. Base64 is a reversible transport encoding and provides no confidentiality. The default URL uses plaintext HTTP. Although the default destination is a loopback address, `HUMMINGBOT_API_URL` is configurable and is not validated to ensure that non-loopback destinations use HTTPS. If a user or environment file sets a remote `http://` destination, the Authorization header is transmitted without transport encryption. The Base64 value is placed in an HTTP request header; it is not printed to standard output by this code. Therefore, the sensitive-data risk is network disclosure rather than stdout exfiltration. ### Attack Path 1. `HUMMINGBOT_API_URL` is configured as a remote or network-accessible `http://` endpoint, whether through user error, an untrusted environment file, or manipulated process configuration. 2. The user invokes the arbitrage scanner. 3. The script reads the API username and password and constructs ...[truncated 793 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/find_arb_opps.py:33
Finding

Overbroad Environment-File Loading and Predictable Default Credentials

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/find_arb_opps.py (reported line 35)May include surrounding context.

python
def load_env():
    """Load environment from .env files."""
    for path in ["hummingbot-api/.env", os.path.expanduser("~/.hummingbot/.env"), ".env"]:
        if os.path.exists(path):
            with open(path) as f:

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/find_arb_opps.py (reported line 36)May include surrounding context.

python
def load_env():
    """Load environment from .env files."""
    for path in ["hummingbot-api/.env", os.path.expanduser("~/.hummingbot/.env"), ".env"]:
        if os.path.exists(path):
            with open(path) as f:
                for line in f:

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill invokes network-capable commands and relies on environment variables, but it does not declare any tool scope or permissions boundaries. This is dangerous because an agent or runner may execute external network requests and access sensitive local configuration or credentials without explicit user-visible authorization, increasing the risk of unintended data exposure or unsafe command execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script performs authenticated network requests automatically using credentials loaded from environment or local .env files, but it provides no user-facing disclosure that credentials will be used or that remote requests will be sent. In a skill context, this can surprise users and cause unintended credential use against a configured API endpoint, especially because the endpoint is environment-controlled and may not be localhost in practice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.