ClawHub
Back to skill

Security audit

Gas Tracker

Security checks for vulnerabilities and agentic risk

Overview

This gas tracker is mostly coherent, but its alert mode reports success even when gas is above the user's threshold, which can mislead automated transaction workflows.

Review before installing if you plan to use --alert in scripts, cron jobs, or transaction workflows. The public API lookups are expected for this skill, but do not rely on the command's exit status to decide whether to trade, swap, or submit a transaction until the alert behavior is fixed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/gas_tracker.py:217
Finding

Alert Threshold Violation Returns a Successful Exit Status

Content
View full analysis

Vulnerability Details

File Location: scripts/gas_tracker.py, lines 217-223
Vulnerability Type: Incorrect exit-status handling in security-relevant automation
Risk Level: Medium

The documented behavior in SKILL.md states that alert mode should exit with status 0 when the standard gas price is below the specified threshold and status 1 when it is above the threshold. However, the implementation exits with status 0 in both cases.

python
def check_alert(data: dict, threshold: float):
    avg = data["standard"]
    if avg > threshold:
        print(f"ALERT: Standard gas ({avg:.1f} Gwei) exceeds threshold ({threshold} Gwei)")
    else:
        print(f"OK: Standard gas ({avg:.1f} Gwei) is below threshold ({threshold} Gwei)")
    sys.exit(0)

Technical Analysis

Shell automation commonly uses process exit statuses as control-flow signals. A status of 0 indicates success, while a nonzero status indicates failure or an unmet condition. Because check_alert() unconditionally invokes sys.exit(0), callers cannot distinguish an acceptable gas price from one that exceeds the configured threshold.

This directly contradicts the documented contract in SKILL.md and breaks the supplied automation pattern:

bash
python scripts/gas_tracker.py --alert 30 && echo "Gas is low, good to swap!" || echo "Gas too high"

When the standard gas price exceeds 30 Gwei, the program prints an alert but still returns success. The shell therefore executes the success branch and reports that gas is low. Any financial operation attached to that branch would also be executed.

Attack Path

  1. A user or scheduled task invokes gas_tracker.py --alert GWEI and relies on its exit status.
  2. One of the configured remote gas APIs supplies a standard gas price above the threshold, whether due to legitimate network congestion, erroneous data, or compromised upstream data.
  3. `ch ...[truncated 871 chars]
Remediation
View remediation

Remediation Suggestions

Return a nonzero status when the threshold is exceeded and status 0 otherwise:

python
def check_alert(data: dict, threshold: float):
    avg = data["standard"]
    if avg > threshold:
        print(
            f"ALERT: Standard gas ({avg:.1f} Gwei) "
            f"exceeds threshold ({threshold} Gwei)"
        )
        sys.exit(1)

    print(
        f"OK: Standard gas ({avg:.1f} Gwei) "
        f"is below threshold ({threshold} Gwei)"
    )
    sys.exit(0)

Additionally:

  1. Add automated tests for prices below, equal to, and above the threshold.
  2. Explicitly define whether equality is acceptable. The current comparison treats equality as acceptable, while the message says “below”; either change the message to “does not exceed” or change the comparison to match the intended policy.
  3. Add an integration test that executes the documented shell example and verifies that the correct branch is selected.
  4. Treat upstream API data as advisory and require additional validation before attaching irreversible financial operations to this command.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill documentation describes live network access to multiple public RPC and explorer endpoints, but the manifest does not declare any explicit tool scope or allowed-tools/permissions boundary. This creates an authorization and review gap: a runtime or agent may grant broader network capability than reviewers or policy systems can easily verify, increasing the chance of unintended outbound requests or future abuse if the skill is modified.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/gas_tracker.py (reported line 86)May include surrounding context.

python
def fetch_blockscout():
    """Fetch gas via blockscout public API."""
    try:
        url = "https://api.blockscout.com/api/v1/gasOracle"
        req = urllib.request.Request(
            url, headers={"Accept": "application/json", "User-Agent": "Mozilla/5.0"}
        )

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/gas_tracker.py (reported line 135)May include surrounding context.

python
def fetch_eth_api():
    """Last resort: try to fetch from ethereum API page."""
    try:
        url = "https://api.ethgas.watch/api/gas"
        req = urllib.request.Request(
            url, headers={"Accept": "application/json", "User-Agent": "Mozilla/5.0"}
        )

Static analysis

No suspicious patterns detected.