Sales Crypto Sentiment Agent

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:17 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent crypto trading-signal prompt, but its install metadata pulls an unexplained unpinned Node package and requests curl, which users should review before installing.

Review the install dependency before enabling this skill. It may be useful for crypto market analysis, but treat any generated signal as informational only, and do not rely on it for trades without independent verification and risk controls.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: skill.md:5

Finding

Unpinned Third-Party Package Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: skill.md, lines 5–10
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Affected code:

yaml

metadata: {
  openclaw: {
    requires: { bins: ["curl"] },
    install: [
      { id: "node", kind: "node", package: "clawhub", bins: ["clawhub"] }
    ]
  }
}

Technical Analysis

The installation metadata declares the Node.js package clawhub without an exact version, package integrity hash, or trusted registry reference. Consequently, package resolution can select mutable content available from the configured package registry at installation time rather than a specific audited artifact.

If the package name is compromised, transferred, replaced, or resolved through an attacker-controlled registry, installation may retrieve attacker-controlled code. Node.js packages can include lifecycle scripts that execute during installation unless explicitly disabled. The declared curl requirement also provides a general-purpose network retrieval utility even though this skill does not document a legitimate use for it, unnecessarily expanding the available network capability.

The reviewed project does not itself contain a malicious payload, invoke curl, or demonstrate that the current clawhub package is malicious. The issue is the absence of controls that ensure future installations use the exact dependency content reviewed and approved by the project owner.

Attack Path

1. An attacker compromises the package publisher, registry account, package namespace, or registry configuration used to resolve clawhub.
2. The attacker publishes a malicious release under the same unversioned package name or causes dependency resolution to use an attacker-controlled registry.
3. A user or automated environment installs the skill and resolves the current package release rather than a pinned, previously audited version.
4. The package manager downloads ...[truncated 1044 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin clawhub to an exact, audited version rather than allowing installation of an arbitrary current release.
2. Record and verify a cryptographic integrity hash through a lockfile or equivalent package-verification mechanism.
3. Configure installation to use an explicit, trusted registry and reject unexpected registry overrides.
4. Disable Node.js package lifecycle scripts during installation where the dependency does not require them.
5. Review the selected package version, including its transitive dependencies and lifecycle scripts, before approval.
6. Use automated dependency monitoring and require manual review before updating the pinned version or integrity metadata.
7. Remove the curl requirement if the skill does not use it. If network retrieval is necessary, document the intended endpoints and restrict outbound access to those destinations.
8. Run installation and execution under a least-privileged account without access to unrelated credentials or sensitive host resources.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases include broad, conversational terms like "bullish or bearish" and "analyze bitcoin" that can plausibly appear in ordinary discussion, increasing the chance the skill is invoked unintentionally or in the wrong context. Because this skill produces trading-oriented analysis, accidental activation can expose users to unsolicited financial guidance and cause confusing or risky downstream behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill defines structured trading signals with entry, stop loss, and take profit fields, which makes the output resemble actionable trading advice, yet it does not pair that behavior with a prominent, explicit financial risk warning at the point of use. In a volatile crypto context, users may over-rely on the signals as advice, increasing the risk of financial harm or misuse despite the softer disclaimer language elsewhere in the file.

Content

No source excerpt is available for this finding.