Security audit

Kraken CLI

Security checks for vulnerabilities and agentic risk

Overview

This Kraken trading skill is purpose-aligned, but it needs review because raw and configurable interfaces can weaken safeguards around account-changing API calls and authentication material.

Install only after reviewing the raw private and WebSocket workflows. Use least-privilege Kraken API keys, prefer read-only keys unless trading is required, avoid untrusted OPENCLAW_KRAKEN_CONFIG files, keep endpoint variables pinned to official Kraken hosts, and do not route command output containing challenge signatures into logs or shared transcripts.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: lib/kraken_validate.sh:3
Finding: Private API credentials and WebSocket tokens can be redirected to attacker-controlled hosts
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: bin/openclaw-kraken:157
Finding: Raw private API interfaces bypass state-change confirmation controls
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: lib/kraken_config.sh:3
Finding: Configuration loading executes arbitrary shell code
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: bin/openclaw-kraken:325
Finding: Futures WebSocket challenge command prints authentication material to stdout
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared purpose centers on Kraken exchange operations via a Bash CLI, including API queries, account inspection, trading/funding actions, and websocket payload handling. The actual code chunk does none of these things. It is a packaging/release helper script for versioning and publishing the skill itself. This is a materially different primary purpose, with unrelated capabilities and resources, so it should be flagged as a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description describes a full-featured Kraken trading/account CLI. The provided code chunk is only a small support script that outputs a constant nonce, likely for testing. This behavior is materially narrower and unrelated to the declared primary purpose when evaluated in isolation, so the description does not accurately represent what this specific code chunk actually does.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill exposes shell-based operational capability but does not declare any explicit tool scope or permissions boundary. In an agent ecosystem, that increases the chance the skill can be invoked with broader-than-expected execution privileges, making misuse or unintended command execution harder to constrain and audit.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script executes whatever command string is referenced by the KRAKEN_NONCE_CMD environment variable. Because this file operates in a high-value context with API credentials and trading capabilities, an attacker who can influence the environment can trigger arbitrary command execution, potentially leading to secret theft, unauthorized trades, or broader host compromise.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The function reads KRAKEN_API_SECRET and transforms it for signing, which is access to sensitive credentials. In this file there is no confirmation, logging, comment, or docstring disclosing that credential material is being consumed.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The function sources a Bash file from the environment-controlled OPENCLAW_KRAKEN_CONFIG path, which causes arbitrary shell code in that file to execute in the current process. In a skill that manages trading actions and secrets, this is especially dangerous because a malicious config can exfiltrate API credentials, alter endpoints, disable safeguards, or execute arbitrary commands before any business logic runs.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill implicitly trusts and sources a config file specified by an environment variable without clear disclosure, making behavior depend on hidden ambient state. This increases the chance that users or calling systems unknowingly execute attacker-controlled configuration, particularly in automated environments where environment variables may be inherited or injected.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: For signed requests, the function reads sensitive environment variables and sends authentication headers over the network, but this shell file provides no confirmation prompt and no user-facing disclosure in comments or docstrings near the behavior. This matches the missing-warning criterion for code files because it handles credentials and transmits them externally.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The request helper supports state-changing HTTP methods that can modify or cancel futures resources, yet there is no confirmation prompt or inline user disclosure here describing that such operations may be irreversible or account-affecting. Although the skill may be intended for exchange operations, this file alone does not visibly warn users about these safety-critical actions.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.