ClawHub
Back to skill

Security audit

Fresh Feeds

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed paid API helper for MCP and x402 service discovery, with no hidden local access or persistence found.

Install only if you want this remote registry service. Use the free preview and health endpoints by default, and configure any x402 wallet with strict per-call and session limits so paid requests cannot spend more than you intend.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:52
Finding

Paid API Requests Can Trigger Automatic Cryptocurrency Transactions Without Per-Call Approval

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 52–71
Vulnerability Type: Automatic financial transaction without explicit per-call authorization
Risk Level: Medium

Complete Code Snippet

markdown
## Paid endpoints (x402 — USDC on Base, auto-settled)
These return the **full** dataset/report. They respond `HTTP 402 Payment Required` with an x402
challenge; your x402 auto-handler signs a USDC micropayment on Base and retries automatically
(within your configured budget):

| Endpoint | Price | Returns |
|---|---|---|
| `GET /feeds/mcp-registry` | $0.05 | full deduped, quality-scored MCP registry snapshot |
| `GET /feeds/mcp-registry/changes?since=YYYY-MM-DD` | $0.02 | added/removed/score-changed servers since a daily baseline (cheap habit endpoint) |
| `GET /feeds/x402-services` | $0.05 | full x402 services catalog with liveness data |
| `GET /verify/mcp?server=<NAME>` | $0.03 | full verification report: live endpoint probe + graded trust signals |

If you do **not** have an x402 wallet/handler, the free `*/preview` + `/health` endpoints answer
most ranking/liveness questions; use ETag `304` to detect new data without paying.

## Workflow
1. Orient with `GET /feeds/mcp-registry/preview` (free top 10) or the landing `/`.
2. For the full ranked corpus, call `GET /feeds/mcp-registry` (paid). To poll cheaply for
   updates, ETag-check first (`If-None-Match`), then `GET /feeds/mcp-registry/changes?since=`.
3. Before depending on a server, verify it: `GET /verify/mcp/preview?server=` (free grade) →
   `GET /verify/mcp?server=` (paid full report) for the live probe + trust signals.
4. To choose a payable service, use `GET /feeds/x402-services` — `alive-402` means up and
   correctly demanding payment (safe to call); ranking puts payable-now services first.

Technical Analysis

The skill recommends paid HTTP endpoints and states that an x402 handler will sign a USDC micropay ...[truncated 2368 chars]

Remediation
View remediation

Remediation Suggestions

  1. Require explicit user confirmation immediately before every paid request. The confirmation should identify the endpoint, asset, blockchain network, recipient, exact or maximum amount, and whether retries are permitted.
  2. Default to the free preview and health endpoints. A paid endpoint should only be selected when the user explicitly requests the full result and accepts the displayed charge.
  3. Disable automatic retries after a payment challenge unless the retry is cryptographically bound to the already authorized payment and cannot create another charge.
  4. Enforce independent per-call and per-session spending limits that are substantially narrower than the wallet's general budget.
  5. Reject payment challenges whose amount, token, network, recipient, or endpoint differs from the values presented to the user.
  6. Add replay protection, transaction identifiers, request deduplication, and a maximum of one settlement attempt per approved operation.
  7. Record an auditable receipt containing the approved request, quoted price, transaction hash, response status, and any retry activity.
  8. Update the workflow to state that agents must never interpret terms such as “safe to call” as authorization to spend funds.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

MCP Config Access

High
Category
Agent Snooping
Confidence
90% confidence
Finding

Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md
`get_registry_changes`, `get_x402_services_snapshot`, `verify_mcp_server_report`

Discovery manifests: `GET /.well-known/agent-card.json` (A2A), `GET /openapi.json` (OpenAPI 3.1),
`GET /.well-known/mcp.json` (MCP descriptor). The REST endpoints below remain available for direct
HTTP/curl use.

## When to use

Static analysis

No suspicious patterns detected.