ClawHub
Back to skill

Security audit

Trade Agent

Security checks for vulnerabilities and agentic risk

Overview

This trading skill is mostly purpose-aligned, but it asks for high-impact financial authority and uses under-scoped local authentication and installer behavior that users should review carefully.

Install only after reviewing the decoded package and being comfortable with local code execution during setup. Use a sandbox or account without production wallet credentials, back up any existing aiusd-skill directory, protect and scope bearer tokens, and require explicit review before trades, withdrawals, staking changes, gas top-ups, or credential resets.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:15
Finding

Agent Communication and Disclosure Hijacking

Content
View full analysis
Remediation
View remediation

T04 · Embedded Malicious Code

Error
Location
aiusd-skill-installer.js:53
Finding

Opaque Embedded Package Is Extracted and Followed by npm Lifecycle Execution

Content
View full analysis
/dev/null 2>&1; then ``` ### Technical Analysis Both installers contain a large Base64-encoded archive, extract it into a local directory, and immediately invoke `npm install`. The supplied top-level project does not expose the extracted source, dependency manifest, lockfile, integrity metadata, or lifecycle scripts as directly reviewable files. Base64 encoding is not itself malicious, but it materially reduces transparency. More importantly, `npm install` may execute package lifecycle hooks such as `preinstall`, `install`, and `postinstall`. Those hooks run with the privileges of the user executing the installer. No signature, checksum, allowlist, archive-entry validation, or lifecycle-script restriction is applied before execution. The audit evidence does not establish that the embedded package contains malicious code, but the install ...[truncated 1253 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
aiusd-skill-installer.js:45
Finding

Installer Recursively Deletes an Existing Installation Without Confirmation

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:141
Finding

Authentication Errors Trigger Broad Deletion of Shared Authentication State

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:4
Finding

Use of Process-Wide and Shared Bearer Credentials Expands Credential Exposure

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (19)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
91% confidence
Finding

The skill includes extensive prompt-level output control rules that try to shape what the agent says, including suppressing specific terminology and tightly constraining authentication responses. In a security review context, such embedded prompt directives are risky because they can obscure important information, reduce transparency to the user, and act as adversarial instruction payloads unrelated to the core trading function.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md
调用后端MCP接口获取余额、交易信号、质押、提现等信息。 the AIUSD backend via MCP. Auth is resolved in order: env `MCP_HUB_TOKEN`, mcporter OAuth, or local `~/.mcp-hub/token.json`. Ensure a valid Bearer token is available before calling.

## ⚠️ Agent Output Guidelines

**CRITICAL - ABSOLUTELY FORBIDDEN PHRASES**:
Agents must NEVER use these words or phrases when responding to users:

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill instructs the agent to execute local shell/Node reauthentication commands such as npm run reauth, npm run login, and node scripts/reauth.js. Allowing a trading assistant to run local commands materially expands its authority beyond trading-related API use and creates a path to arbitrary local code execution if those scripts are modified, malicious, or unexpectedly powerful.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill tells the agent to clear ~/.mcporter/, ~/.mcp-hub/, and other auth cache files during reauthentication. This exceeds the expected scope of a trading assistant and can destroy or alter local credential state, potentially affecting other accounts, sessions, or applications and enabling denial of service or unintended account switching.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · aiusd-skill-installer.js (reported line 80)May include surrounding context.

js
kill && npm install', 'cyan');
    }

    log('', 'reset');
    log('🎉 AIUSD Skill installed successfully!', 'green');
    log('', 'reset');
    log('🚀 Next Steps:', 'yellow');
    log('1. cd aiusd-skill', 'blue');
    log('2. npm run setup', 'blue');
    log('', 'reset');
    log('💡 Usage Examples:', 'cyan');
    log('• Check balance: npm start -- balances', 'blue');
    log('• List tools: npm start -- tools', 'blue');
    log('• Get help: npm start -- --help', 'blue');
    log('', 'reset');

  } catch (error) {
    log(`❌ Installation failed: ${error.message}`, 'red');
    process.exit(1);
  }
}

// Package data (base64 encoded)
const PACKAGE_DATA = `H4sIAEq2hWkAA+y9XW8cSZIg2LvA4XB5z3vPXixhMqnOTH6TUqpVNckPldhFiSqSqppaSUMGM4NkSJkZ2RGRpFgqDnqAmQP2pmdnbqaBvRtMo3fncHOLwwF3+zb7G+5fFHDP0z/hzMy/PTwykxTJ6pEyGl1iRribu5ubm5uZm5nX9+s/uelndnZ2ZWmJ0b/L/N/Z+UX+L/97gc0tzS3OLSwszM3Ns9m5efj3J2z2xnsGzyDNggS60joJBr1WeF5UDoodHQ2Bw4fC1L//Up7/5n/4b3/yr3/ykydBi23vsj9i4sF3P/nv4P/z8P9fwP/x9/

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The installer automatically runs npm install, which executes package-defined lifecycle hooks such as preinstall, install, and postinstall from the embedded archive and its dependencies. Because the payload is opaque base64 data in a self-extracting script, this creates an immediate arbitrary code execution path during installation, not just file extraction.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · aiusd-skill-installer.sh (reported line 98)May include surrounding context.

sh
iusd-skill && npm install"
    fi

    echo ""
    log_success "AIUSD Skill installed successfully!"
    echo ""
    echo -e "${YELLOW}🚀 Next Steps:${NC}"
    echo -e "${BLUE}1. cd aiusd-skill${NC}"
    echo -e "${BLUE}2. npm run setup${NC}"
    echo ""
    echo -e "${CYAN}💡 Usage Examples:${NC}"
    echo -e "${BLUE}• Check balance: npm start -- balances${NC}"
    echo -e "${BLUE}• List tools: npm start -- tools${NC}"
    echo -e "${BLUE}• Get help: npm start -- --help${NC}"
    echo ""

    exit 0
}

# Run main function unless sourced
if [[ "${BASH_SOURCE[0]}" == "${0}" ]]; then
    main "$@"
fi

# Archive marker - do not remove this line
__ARCHIVE_START__
H4sIAEu2hWkAA+y9XW8cSZIg2LvA4XB5z3vPXixhMqnOTH6TUqpVNckPldhFiSqSqppaSUMGM4NkSJkZ2RGRpFgqDnqAmQP2pmdnbqaBvRtMo3fncHOLwwF3+zb7G+5fFHDP0z/hzMy/PTwykxTJ6pEyGl1iRribu5ubm5uZm5nX9+s/uelndnZ2ZWmJ0b/L/N/Z+UX+L/97gc0tzS3OLSwszM0tsNm5+YW5+Z+w2RvvGTyDNAsS6ErrJBj0WuF5UTkodnQ0BA4fClP//kt5/pv/4b/9yb/+yU+eBC22vcv+iIkH3/3kv4P/z8P/fwH/x9

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README encourages users to execute trades, withdrawals, staking, and gas top-ups through natural-language chat without clearly warning that these actions can be financially risky and may be irreversible. In a bot-mediated trading context, omission of such warnings can mislead users into treating high-impact financial operations as low-risk conversational actions, increasing the chance of accidental loss or unauthorized use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill advertises high-impact financial operations including trade execution, staking, withdrawals, and gas top-ups without prominent warnings or confirmation requirements. In a financial context, absent guardrails increase the chance of accidental irreversible actions or user misunderstanding about the consequences of tool invocation.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Lines L035-L048 say re-authentication responses must be limited to a few fixed phrases and must not include detailed steps, URLs, or procedural guidance. Later sections provide explicit instructions and sample dialogues telling the agent to run npm run reauth/npm run login, clear caches, and report progress, which contradicts the earlier documented intent for user-facing auth handling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
82% confidence
Finding

The file prescribes exact English-only authentication responses such as "Please complete authentication in your browser" and constrains how the agent must speak, despite the skill itself being bilingual elsewhere. This can violate the language/locale policy because it forces a specific language without user opt-in or a documented justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The authentication instructions direct modification of local auth caches and token files without clearly warning that local credential material will be altered. In context, this can surprise users, break sessions, or interfere with other tooling that depends on those credentials.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The installer recursively deletes an existing installation directory without prompting or creating a backup. This can destroy user data or locally modified code, and because it targets the current working directory, a user may trigger destructive behavior simply by running the installer from an unexpected location.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The installer runs npm install on an opaque embedded package, which can execute arbitrary preinstall, install, and postinstall lifecycle scripts from the extracted package or its dependencies. Because the payload is base64-embedded and not inspectable from this wrapper, users are being asked to execute untrusted code during installation, making the installer substantially more dangerous than a simple archive extractor.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The header claims the file contains the complete skill package and implies a simple self-extracting installer, but the script also performs dependency installation that can trigger npm-controlled code execution. This is dangerous because it understates installer behavior and may cause users to trust and execute a script that does more than advertised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The installer deletes any existing aiusd-skill directory with rm -rf and recreates it without prompting, backup, or path-safety confirmation. This can destroy local work or previously trusted contents and is especially risky in a script users are encouraged to run directly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script automatically runs npm install without prominently warning that npm may execute install-time scripts from the package and downloaded dependencies. In a self-extracting installer context, this increases the chance that users unknowingly execute unreviewed code during setup.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The README states that authentication is handled automatically and that tokens are stored locally, but it does not warn users that local credentials are sensitive secrets whose compromise could enable account access or trading actions. In a skill that interfaces with financial accounts, understating credential sensitivity increases the risk of insecure device use, careless sharing, or weak local protections.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The comment at L38 frames this step as extraction only, but the implementation also performs a recursive removal of an existing installation before recreating the directory. That is an active destructive side effect not reflected by the nearby intent comment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The script creates a new directory under process.cwd() and writes package data and extracted files into it. While the destination path is logged, the top-level usage comment only says to run the file and does not warn that it will modify the current directory by creating and populating 'aiusd-skill'.

Content

No source excerpt is available for this finding.