ClawHub
Back to skill

Security audit

Bitpanda

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to be a legitimate read-only Bitpanda portfolio viewer, but it handles a financial API key in a way that can expose it to local process inspection.

Review before installing if you use Bitpanda or have a sensitive API key. Use a dedicated read-only Bitpanda key with the minimum scopes, avoid broader permissions, and consider fixing the curl header handling before use so the key is not exposed in process arguments. Do not rely on the unused --wallet, --from, or --to transaction filters unless they are implemented.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/bitpanda.sh:38
Finding

Bitpanda API Key Exposed Through Process Command-Line Arguments

Content
View full analysis
/dev/null) ``` ### Technical Analysis The script expands the Bitpanda API key directly into the argument list passed to `curl`. Although transmitting the key to the official Bitpanda HTTPS endpoint is necessary for authenticated portfolio operations, including it in a command-line argument is not required. While each request is active, the expanded `X-Api-Key` header may be observable through local process-inspection mechanisms such as `ps`, `/proc//cmdline`, process-monitoring software, debugging tools, or audit systems. Exploitability depends on the operating system's process-visibility configuration and the attacker's local privileges. On systems where users can inspect another process's arguments—or where another compromised process runs under the same account—the credential can be recovered. HTTPS protects the key in transit but does not protect it from local process-argument disclosure before transmission. ### Attack Path 1. The user invokes a command such as `bitpanda portfolio`, `bitpanda wallets`, `bitpanda transactions`, or `bitpanda asset BTC`. 2. The script loads the API key from `BITPANDA_API_KEY` or `~/.openclaw/credentials/bitpanda/config.json`. 3. The script interpolates the key into `curl`'s `-H` command-line argument. 4. A local attacker or comprom ...[truncated 1198 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 24)May include surrounding context.

text
   Or save it to a credentials file (auto-detected):
   ```bash
   mkdir -p ~/.openclaw/credentials/bitpanda
   echo '{"api_key": "your_api_key_here"}' > ~/.openclaw/credentials/bitpanda/config.json
   chmod 600 ~/.openclaw/credentials/bitpanda/config.json

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 26)May include surrounding context.

bash
   mkdir -p ~/.openclaw/credentials/bitpanda
   echo '{"api_key": "your_api_key_here"}' > ~/.openclaw/credentials/bitpanda/config.json
   chmod 600 ~/.openclaw/credentials/bitpanda/config.json

Usage

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/bitpanda.sh (reported line 7)May include surrounding context.

sh
# Bitpanda API CLI wrapper
# Read-only portfolio and transaction viewer

API_BASE="https://api.bitpanda.com/v1"

# Load API key: env var > credentials file
CRED_FILE="${HOME}/.openclaw/credentials/bitpanda/config.json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/bitpanda.sh (reported line 352)May include surrounding context.

sh
# Bitpanda API CLI wrapper
# Read-only portfolio and transaction viewer

API_BASE="https://api.bitpanda.com/v1"

# Load API key: env var > credentials file
CRED_FILE="${HOME}/.openclaw/credentials/bitpanda/config.json"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/bitpanda.sh (reported line 371)May include surrounding context.

sh
# Bitpanda API CLI wrapper
# Read-only portfolio and transaction viewer

API_BASE="https://api.bitpanda.com/v1"

# Load API key: env var > credentials file
CRED_FILE="${HOME}/.openclaw/credentials/bitpanda/config.json"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script automatically reads a Bitpanda API key from a local credentials file without explicit user disclosure or confirmation. In an agent-skill context, implicit credential harvesting increases risk because executing the skill causes authenticated external requests using a secret the user may not realize is being consumed.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The transaction command parses --wallet, --from, and --to options into local variables, implying those filters affect the query, but only --flow is actually incorporated into the request parameters. This is an intent-code divergence because the documented interface advertises scoped transaction filtering that the implementation does not perform.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The header comment frames the script as a read-only viewer for portfolio and transaction data, yet cmd_asset fetches public ticker pricing and computes asset valuation, which is a broader market-data capability than the stated scope. While still read-only, this comment materially understates what the script does.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.