ClawHub
Back to skill

Security audit

flow

Security checks for vulnerabilities and agentic risk

Overview

The skill is clearly about paid Base-chain trading support, but it asks users to run unpinned external code that manages a local wallet and signs payments.

Review before installing. Only run this if you are comfortable with the publisher and package provenance, preferably using a pinned package version or verified source. Fund the generated wallet with only a small amount you can afford to lose, and inspect or monitor the wallet and spend ledger because payments are designed to be automatic within the configured caps.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Rp1

Medium
Category
MCP Rug Pull
Confidence
97% confidence
Finding

The skill instructs users to install and execute an MCP server via npx -y @flowexecutor/flow-mcp without pinning a specific version or integrity hash. Because npx fetches the latest published package at execution time, a compromised maintainer account, poisoned dependency, or malicious new release could cause arbitrary code execution on the user's machine; in this skill's context that is especially sensitive because the tool creates and manages a local wallet and signs payment authorizations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.