ClawHub
Back to skill

Security audit

Crypto Executor Optimizer

Security checks for vulnerabilities and agentic risk

Overview

This skill openly automates a crypto trading bot, but it also downloads mutable code, stores exchange credentials, modifies executable trading logic, restarts services, and installs recurring execution with weak guardrails.

Review this carefully before installing. Only use it with tightly scoped Binance API keys, withdrawals disabled, limited capital, and a dedicated unprivileged account. Do not run the setup until downloaded code is pinned or verified, credentials are stored as data rather than sourced shell, optimizer inputs are validated, and recurring cron execution is explicitly acceptable for your trading risk.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (7)

T03 · Remote Payload Retrieval and Execution

Error
Location
setup_binance_20euros.sh:37
Finding
Mutable Remote Trading Code Is Downloaded and Executed Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `setup_binance_20euros.sh:37-68`, with execution at `setup_binance_20euros.sh:167-190` **Vulnerability Type**: Mutable remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash if [ ! -f "$EXECUTOR_PATH" ]; then echo "" echo "❌ executor.py not found. Installing from GitHub..." wget -q "https://raw.githubusercontent.com/georges91560/crypto-executor/main/executor.py" \ -O "$EXECUTOR_PATH" if [ ! -f "$EXECUTOR_PATH" ]; then echo "❌ Download failed. Install manually:" echo " wget https://raw.githubusercontent.com/georges91560/crypto-executor/main/executor.py \\" echo " -O $EXECUTOR_PATH" exit 1 fi echo "✅ executor.py installed" else echo "✅ executor.py found" fi ORACLE_PATH="/workspace/skills/crypto-sniper-oracle/crypto_oracle.py" if [ ! -f "$ORACLE_PATH" ]; then echo "" echo "⚠️ crypto-sniper-oracle not found. Installing..." mkdir -p /workspace/skills/crypto-sniper-oracle wget -q "https://raw.githubusercontent.com/georges91560/crypto-sniper-oracle/main/crypto_oracle.py" \ -O "$ORACLE_PATH" ``` The downloaded executor is subsequently launched: ```bash source "$CONFIG_FILE" if systemctl list-unit-files crypto-executor.service &>/dev/null; then sudo systemctl start crypto-executor # ... fi nohup python3 "$EXECUTOR_PATH" > /workspace/logs/binance_bot.log 2>&1 & ``` ### Technical Analysis Both Python programs are retrieved from the mutable `main` branches of personal GitHub repositories. No commit pin, release signature, expected SHA-256 digest, content validation, or review gate is enforced. Checking only whether the destination file exists does not establish that the download succeeded completely or that its contents are trustworthy. The main executor is then run with Binance credentials loaded into its environment. Project documentation also states that the ora ...[truncated 1667 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Vendor the reviewed Python files into the audited release, or pin downloads to immutable full commit hashes. 2. Publish expected SHA-256 hashes in the Skill package and verify them before installation: ```bash printf '%s %s\n' "$EXPECTED_SHA256" "$EXECUTOR_PATH" | sha256sum -c - ``` 3. Abort on any download or verification error. Use `curl --fail --show-error --location` or check `wget`'s exit status rather than checking only for file existence. 4. Download to a temporary file created with `mktemp`, verify it, then atomically move it into place. 5. Require explicit user confirmation after displaying the source revision and verified digest. 6. Run the trading process under a dedicated unprivileged account with a restrictive systemd sandbox. 7. Restrict Binance keys to trading-only permissions, disable withdrawals, use IP allowlisting, and use a dedicated sub-account with limited capital. 8. Treat the executor and oracle as separate reviewed artifacts with independent hashes and release provenance. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
apply_optimization.sh:88
Finding
Optimizer Arguments Are Interpolated Directly Into Executable Python Source<![CDATA[ ## Vulnerability Details **File Location**: `apply_optimization.sh:88-157` **Vulnerability Type**: Python code injection and missing parameter validation **Risk Level**: High ### Vulnerable Code ```bash python3 << PYEOF import re import sys path = "$EXECUTOR_PATH" with open(path) as f: code = f.read() original = code changes = [] def replace_val(code, pattern, new_val, label): """Replace first capture group with new_val.""" def repl(m): return m.group(0).replace(m.group(1), new_val) new_code, n = re.subn(pattern, repl, code, count=1) if n > 0: changes.append(f"{label}: → {new_val}") return new_code if "$OBI_SCALPING": code = replace_val(code, r'if obi > ([\d.]+) and spread_bps', "$OBI_SCALPING", "OBI scalping") if "$OBI_MOMENTUM": code = replace_val(code, r'if obi > ([\d.]+) and price_change', "$OBI_MOMENTUM", "OBI momentum") if "$PRICE_CHANGE": code = replace_val(code, r'price_change > ([\d.]+)', "$PRICE_CHANGE", "price_change trigger") if "$SPREAD_BPS": code = replace_val(code, r'spread_bps < ([\d.]+)', "$SPREAD_BPS", "spread_bps filter") if "$KELLY_FACTOR": code = replace_val(code, r'kelly \* ([\d.]+)', "$KELLY_FACTOR", "Kelly factor") ``` ### Technical Analysis The here-document delimiter is unquoted, so shell variables are expanded into the Python program before Python executes it. Values parsed from command-line arguments are inserted into Python string literals and `if` statements without escaping. A value containing quotes, newlines, or Python syntax can terminate the intended string and inject statements into the temporary Python program. This code runs before `py_compile` validates the modified executor, so syntax validation does not prevent execution of the injected optimizer payload. The script also does not enforce the numeric types or documented mi ...[truncated 1857 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Do not generate a Python program by interpolating shell values. Pass values as arguments or through a strictly encoded data file: ```bash python3 optimizer.py \ --obi-scalping "$OBI_SCALPING" \ --obi-momentum "$OBI_MOMENTUM" ``` 2. If a here-document remains necessary, quote its delimiter (`<<'PYEOF'`) and pass data through `sys.argv` or environment variables. 3. Use `argparse` with `type=float`, reject NaN and infinity, and enforce every documented range. 4. Enforce cross-field invariants, especially that strategy weights are non-negative and sum to exactly one within a small tolerance. 5. Reject unknown options, missing option values, duplicate options, and nonnumeric input instead of silently ignoring them. 6. Build and validate a complete candidate file in a private temporary location. Only atomically replace the live executor after syntax, semantic, and policy validation succeeds. 7. Do not allow unconstrained language-model output to become executable optimizer input; use a fixed JSON schema and deterministic validator. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
setup_binance_20euros.sh:120
Finding
Credential Values Are Written as Shell Code and Later Sourced<![CDATA[ ## Vulnerability Details **File Location**: `setup_binance_20euros.sh:120-139`, with execution at `setup_binance_20euros.sh:167-170` and `apply_optimization.sh:201-203` **Vulnerability Type**: Shell injection through an executable configuration file **Risk Level**: High ### Vulnerable Code ```bash cat > "$CONFIG_FILE" << EOF # Binance Bot Configuration — Generated $(date) # ⚠️ chmod 600 this file BINANCE_API_KEY="$BINANCE_API_KEY" BINANCE_API_SECRET="$BINANCE_API_SECRET" TELEGRAM_BOT_TOKEN="$TELEGRAM_BOT_TOKEN" TELEGRAM_CHAT_ID="$TELEGRAM_CHAT_ID" # Capital & Position Sizing (20€ conservative) MAX_POSITION_SIZE_PCT="12" DAILY_LOSS_LIMIT_PCT="2" WEEKLY_LOSS_LIMIT_PCT="5" DRAWDOWN_PAUSE_PCT="7" DRAWDOWN_KILL_PCT="10" EOF chmod 600 "$CONFIG_FILE" ``` The generated file is executed as shell syntax: ```bash source "$CONFIG_FILE" ``` It is also sourced during optimizer fallback restart: ```bash if [ -f "/workspace/data/bot_config.env" ]; then source /workspace/data/bot_config.env fi ``` ### Technical Analysis Credential values are embedded verbatim inside double-quoted shell assignments. A value containing a double quote followed by a newline can terminate the assignment and add arbitrary shell commands to the generated file. `chmod 600` protects the file from other local users, but it does not make its contents safe to execute. Every subsequent `source` treats the file as code rather than data. This converts malformed, attacker-supplied, or compromised configuration content into shell command execution. The setup also sources the file before directly launching the downloaded executor, and the optimizer repeatedly sources it whenever the systemd restart path fails. ### Attack Path 1. A malicious value is supplied through an inherited environment variable or interactive credential input, or a process with access to the user's workspace modifies `bot_config.env`. 2. The value closes the generated shell quote and inserts a command on a new l ...[truncated 809 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Do not source a credential file. Store credentials as non-executable data, such as a root/user-readable JSON file, and parse it with a non-evaluating parser. 2. Prefer a dedicated secret manager or systemd credentials for service execution. 3. If shell assignment format is unavoidable, serialize values with a correct shell-escaping function such as `printf '%q'`, then tightly validate allowed characters and lengths. 4. Create the file with restrictive permissions from the outset rather than applying permissions only after writing: ```bash umask 077 tmp=$(mktemp /workspace/data/bot_config.env.XXXXXX) ``` 5. Atomically move the completed file into place and verify that it is a regular file owned by the expected user, not a symbolic link. 6. Reject embedded newlines and control characters in all credential and identifier fields. 7. Configure the service to receive secrets through a protected environment mechanism without evaluating file contents as shell commands. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
setup_binance_20euros.sh:89
Finding
Binance API Secret Is Collected With Terminal Echo Enabled<![CDATA[ ## Vulnerability Details **File Location**: `setup_binance_20euros.sh:89-101` **Vulnerability Type**: Sensitive input exposure **Risk Level**: Medium ### Vulnerable Code ```bash if [ -z "$BINANCE_API_KEY" ]; then echo "📝 Binance API Key:" read -r BINANCE_API_KEY export BINANCE_API_KEY fi if [ -z "$BINANCE_API_SECRET" ]; then echo "📝 Binance API Secret:" read -r BINANCE_API_SECRET export BINANCE_API_SECRET fi ``` ### Technical Analysis The Binance API secret is collected using ordinary `read`, which leaves terminal echo enabled. The secret is therefore displayed as it is typed. The Telegram bot token is collected in the same manner later in the script. Although the saved credential file receives mode `600`, that permission does not protect credentials while they are visibly entered. The values are also exported into the process environment, making them available to child processes. ### Attack Path 1. A user runs setup in a shared terminal, recorded remote-support session, screen-sharing session, or environment with terminal capture. 2. The user types the Binance secret or Telegram token. 3. The secret is rendered on screen and may be observed or retained in a recording or terminal log. 4. An observer uses the exposed secret with its corresponding API key. ### Impact Assessment Exposure of the Binance API secret can allow unauthorized API use within the permissions assigned to the key, including account inspection and trading. Exposure of the Telegram bot token can permit unauthorized bot API calls. The financial impact depends on the Binance key's restrictions and withdrawal permissions. ]]>
Remediation
<![CDATA[ ## Remediation Suggestions 1. Read secrets without terminal echo: ```bash IFS= read -r -s BINANCE_API_SECRET printf '\n' ``` 2. Apply the same handling to the Telegram bot token. 3. Prefer secret-manager integration or protected file-descriptor input over interactive entry. 4. Avoid exporting secrets globally when only one child process needs them. 5. Document that Binance keys must have withdrawals disabled, use IP allowlisting, and be limited to the minimum required API permissions. ]]>

T06 · System Persistence

Error
Location
install_cron.sh:29
Finding
Recurring Autonomous Trading Optimizer Is Installed as Persistent Cron Execution<![CDATA[ ## Vulnerability Details **File Location**: `install_cron.sh:29-51` **Vulnerability Type**: Persistent scheduled autonomous execution **Risk Level**: High ### Vulnerable Code ```bash openclaw cron add \ --name "crypto-executor-optimizer" \ --cron "0 */6 * * *" \ --session isolated \ --message "Run the crypto-executor-optimizer skill. Read /workspace/performance_metrics.json and /workspace/skills/crypto-executor/executor.py, analyze performance, decide what to optimize, then call apply_optimization.sh with the new values." if [ $? -eq 0 ]; then echo "✅ Cron OpenClaw installé (toutes les 6h)" else echo "⚠️ openclaw CLI non disponible. Fallback crontab système..." CRON_LINE="0 */6 * * * openclaw run --skill crypto-executor-optimizer >> /workspace/logs/cron.log 2>&1" (crontab -l 2>/dev/null | grep -v crypto-executor-optimizer; echo "# Wesley Optimizer") | crontab - (crontab -l 2>/dev/null; echo "$CRON_LINE") | crontab - echo "✅ Cron système installé en fallback" fi ``` ### Technical Analysis Persistence is part of the Skill's declared autonomous functionality, so the presence of a recurring job is not hidden. Nevertheless, it creates a high-impact cross-session execution path: every six hours an agent is instructed to read mutable local files, decide how to alter a live trading program, invoke the optimizer, and restart the bot. The fallback is activated for every nonzero result from `openclaw cron add`, not only when the CLI is unavailable. Authentication errors, invalid configuration, or temporary failures therefore cause installation into a separate persistence mechanism. The fallback uses an unqualified `openclaw` command name, relying on cron's `PATH` resolution. It also provides no duplicate-safe, exact entry management beyond removing every existing line containing the Skill identifier. The installer reports success without verifying the resulting crontab entry. Its displayed uninstall command covers Open ...[truncated 1445 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Make recurring execution an explicit optional installation step with a clear confirmation describing financial and persistence implications. 2. Default to analysis-only operation. Require human approval before applying changes or restarting the trading bot. 3. Distinguish “command not found” from all other `openclaw cron add` failures. Do not silently switch persistence backends after authentication or configuration errors. 4. Use an absolute, verified path to the `openclaw` executable and a minimal fixed cron environment. 5. Use a dedicated wrapper with fixed permissions instead of embedding an open-ended agent instruction in the scheduled task. 6. Add a lock file, maximum-run duration, audit record, and disable switch. 7. Verify installation and provide backend-specific removal commands. The uninstall process should remove both OpenClaw and system-crontab entries safely. 8. Protect all scheduled inputs from modification by less-trusted processes and validate the integrity of the Skill before every run. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
apply_optimization.sh:187
Finding
Restart Failure Does Not Trigger the Documented Rollback<![CDATA[ ## Vulnerability Details **File Location**: `apply_optimization.sh:187-229` **Vulnerability Type**: Fail-open deployment and incomplete rollback **Risk Level**: High ### Vulnerable Code ```bash sudo systemctl restart crypto-executor 2>/dev/null if systemctl is-active --quiet crypto-executor 2>/dev/null; then log "✅ Bot restarted via systemd" RESTART_OK=true else log "systemd unavailable, using pkill fallback..." pkill -f "executor.py" 2>/dev/null sleep 3 if [ -f "/workspace/data/bot_config.env" ]; then source /workspace/data/bot_config.env fi nohup python3 "$EXECUTOR_PATH" >> /workspace/logs/binance_bot.log 2>&1 & sleep 3 if pgrep -f "executor.py" > /dev/null; then log "✅ Bot restarted via pkill fallback" RESTART_OK=true else log "❌ Bot failed to restart" RESTART_OK=false fi fi # ... log "========================================" log "OPTIMIZATION COMPLETE ✅" log "========================================" ``` ### Technical Analysis Project documentation states that a failed restart causes automatic rollback. The implementation only restores the backup after source-modification errors or Python syntax errors. When both restart mechanisms fail, it sets `RESTART_OK=false` but does not restore `BACKUP_PATH`, retry the previous version, or exit with a failure status. The script subsequently logs “OPTIMIZATION COMPLETE” and normally exits successfully. This can cause schedulers and operators to treat a failed deployment as successful. `py_compile` checks only Python syntax. It cannot identify missing imports, initialization errors, invalid numeric policy, incompatible runtime assumptions, or failures caused by the modified business logic. The broad `pkill -f "executor.py"` fallback may also terminate unrelated processes whose command lines contain the same filename. ### Attack Path 1. The optimizer writes a syntactically valid but operationally invalid or unsafe ...[truncated 892 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. If the new version fails health checks, atomically restore the backup and restart the previous version. 2. Return a nonzero exit status whenever restart or post-restart validation fails. 3. Replace `pgrep`-only validation with a real health check that verifies the expected PID, command path, service state, initialization, and required API readiness. 4. Use systemd consistently where available. Avoid `pkill -f`; maintain a PID file or use an exact service/cgroup identity. 5. Validate a candidate version in an isolated process before stopping the currently working process. 6. Keep the old process active until the replacement passes readiness checks where architecture permits. 7. Log explicit deployment failure rather than unconditional completion, and ensure scheduled monitoring alerts on nonzero results. ]]>

T08 · Insecure Dependencies

Warning
Location
setup_binance_20euros.sh:75
Finding
Unpinned Package Is Installed Into the System Python Environment<![CDATA[ ## Vulnerability Details **File Location**: `setup_binance_20euros.sh:75-82` **Vulnerability Type**: Unpinned dependency and unsafe Python environment modification **Risk Level**: Medium ### Vulnerable Code ```bash if ! python3 -c "import websocket" 2>/dev/null; then echo "📦 Installing websocket-client (for sub-100ms streams)..." pip install websocket-client --break-system-packages --quiet # On VPS/standard server: prefer → python3 -m venv venv && source venv/bin/activate && pip install websocket-client echo "✅ websocket-client installed" else echo "✅ websocket-client available" fi ``` ### Technical Analysis The dependency has no exact version or integrity hash. Installation therefore resolves whatever package version and transitive dependencies the package index serves at setup time. `--break-system-packages` bypasses Python's externally-managed-environment protection and can alter the interpreter environment used by unrelated applications when permissions allow. The script also invokes `pip` separately from `python3`, so `pip` may target a different interpreter. Finally, it prints a success message without checking the installation command's exit status or verifying the installed module version and origin. The package name appears legitimate; the risk arises from mutable, unpinned dependency resolution and modification of a shared interpreter, not from evidence of typosquatting in the audited files. ### Attack Path 1. The expected `websocket` module is absent. 2. Setup resolves `websocket-client` and its dependencies from the configured package index. 3. A compromised index, account, mirror, DNS/proxy configuration, or future malicious release supplies altered package content. 4. Package installation code executes during installation and the package is later imported by the trading bot. 5. The package gains access to the bot process environment, including credentials. 6. Shared-system installation may also affect other Py ...[truncated 401 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Create a dedicated virtual environment for the bot and invoke pip through the intended interpreter: ```bash python3 -m venv /workspace/venvs/crypto-executor /workspace/venvs/crypto-executor/bin/python -m pip install \ --require-hashes -r requirements.txt ``` 2. Pin exact versions for direct and transitive dependencies. 3. Use a hash-locked requirements file generated from reviewed artifacts. 4. Remove `--break-system-packages`. 5. Check every installation exit status and abort setup on failure. 6. Verify the installed package version and import path before starting the bot. 7. Use a controlled package index or internal artifact repository for production financial software. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (55)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The declared purpose focuses on tuning parameters, yet the documented setup downloads remote code from GitHub, installs Python packages, stores credentials, and controls services and processes. Combining remote code acquisition with privileged lifecycle control materially expands the attack surface and can lead to arbitrary code execution or unauthorized persistent changes.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The declared purpose focuses on tuning parameters, yet the documented setup downloads remote code from GitHub, installs Python packages, stores credentials, and controls services and processes. Combining remote code acquisition with privileged lifecycle control materially expands the attack surface and can lead to arbitrary code execution or unauthorized persistent changes.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The declared purpose focuses on tuning parameters, yet the documented setup downloads remote code from GitHub, installs Python packages, stores credentials, and controls services and processes. Combining remote code acquisition with privileged lifecycle control materially expands the attack surface and can lead to arbitrary code execution or unauthorized persistent changes.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Content
valide
- Rollback automatique si restart échoué
- Conservation des 5 derniers backups uniquement
- Alerte Telegram en cas d'erreur

---

## 📅 Cron & Persistance

Le skill installe un job récurrent via `install_cron.sh` :

```bash
# Schedule : toutes les 6h
0 */6 * * *

# Via OpenClaw cron (prioritaire) :
openclaw cron add --name "crypto-executor-optimizer" --cron "0 */6 * * *"

# Via system crontab (fallback si openclaw CLI indisponible) :
0 */6 * * * openclaw run --skill crypto-executor-optimizer
```

**Désinstaller le cron :**
```bash
openclaw cron remove --name crypto-executor-optimizer
# OU
crontab -e  # supprimer la ligne crypto-executor-optimizer
```

---

## 📁 Fichiers importants

| Fichier | Rôle |
|---|---|
| `/workspace/performance_metrics.json` | Stats de performance du bot |
| `/workspace/learned_config.json` | Historique des configurations précédentes |
| `/workspace/skills/crypto-executor/executor.py` | Le bot à optimiser |
| `/workspace/data/bot_config.env`
Confidence
75% confidence
Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Chaining Abuse

High
Category
Tool Misuse
Content
BACKUP_COUNT=$(ls "$BACKUP_DIR"/executor_backup_*.py 2>/dev/null | wc -l)
if [ "$BACKUP_COUNT" -gt 5 ]; then
    ls -t "$BACKUP_DIR"/executor_backup_*.py | tail -n +6 | xargs rm -f
    log "Old backups cleaned (kept last 5)"
fi
Confidence
75% confidence
Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Content
-executor-optimizer skill. Read /workspace/performance_metrics.json and /workspace/skills/crypto-executor/executor.py, analyze performance, decide what to optimize, then call apply_optimization.sh with the new values."

if [ $? -eq 0 ]; then
    echo "✅ Cron OpenClaw installé (toutes les 6h)"
else
    echo "⚠️  openclaw CLI non disponible. Fallback crontab système..."
    
    # Fallback: crontab système qui demande à Wesley via openclaw
    CRON_LINE="0 */6 * * * openclaw run --skill crypto-executor-optimizer >> /workspace/logs/cron.log 2>&1"
    (crontab -l 2>/dev/null | grep -v crypto-executor-optimizer; echo "# Wesley Optimizer") | crontab -
    (crontab -l 2>/dev/null; echo "$CRON_LINE") | crontab -
    echo "✅ Cron système installé en fallback"
fi

echo ""
echo "========================================"
echo "INSTALLATION COMPLETE"
echo "========================================"
echo ""
echo "📅 Schedule : toutes les 6h (00:00, 06:00, 12:00, 18:00)"
echo ""
echo "
Confidence
75% confidence
Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Description-Behavior Mismatch

High
Confidence
98% confidence
Finding
The script's behavior far exceeds the declared role of an optimizer: it installs code, collects exchange and Telegram credentials, writes persistent configuration, stops existing services, and launches trading software. This capability expansion is dangerous because a user invoking an apparently limited optimization skill could unknowingly grant it control over live trading operations and sensitive secrets.

Context-Inappropriate Capability

High
Confidence
99% confidence
Finding
The script solicits Binance API credentials and Telegram secrets, then persists them locally, even though the skill is described as a tuning optimizer rather than an onboarding or secret-management component. In context, this is especially risky because exchange credentials can enable unauthorized trading or fund movement if over-scoped, and the mismatch between stated purpose and actual secret access increases the chance of deceptive or unsafe deployment.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The README normalizes an agent-driven workflow that reads performance data, modifies `executor.py`, validates it, and restarts the trading service automatically every 6 hours, but it does not prominently warn about the operational and security risks of autonomous code modification. In this context, automated edits to executable trading logic materially increase the chance of unsafe changes, unexpected behavior, or abuse if upstream inputs or the optimizer are compromised.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
tail -f /workspace/logs/auto_optimize.log
tail -f /workspace/logs/wesley_optimizations.log
ls /workspace/skills/crypto-executor/executor_backup_*.py
sudo systemctl status crypto-executor
```

## Fichiers
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
tail -f /workspace/logs/auto_optimize.log
tail -f /workspace/logs/wesley_optimizations.log
ls /workspace/skills/crypto-executor/executor_backup_*.py
sudo systemctl status crypto-executor
```

## Fichiers
Confidence
70% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill declares significant capabilities such as shell execution and file modification but does not expose a strict tool scope like permissions or allowed-tools. This increases the risk of overbroad execution because an agent may invoke powerful operations beyond what reviewers expect from the manifest alone.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
backup, validates Python syntax, and rolls back automatically on error.
    privilege_requirements:
      uses_sudo: true
      reason: "sudo systemctl restart crypto-executor — required to restart the trading bot service"
      uses_crontab: true
      cron_schedule: "0 */6 * * *"
      cron_purpose: "Trigger Wesley optimization cycle every 6 hours"
Confidence
89% confidence
Finding
The skill explicitly requires sudo to restart a service, giving it privileged process-control capability. In the context of a skill that also modifies files and downloads code, elevated restart privileges materially increase the blast radius of any compromise or bad update.

External Transmission

Medium
Category
Data Exfiltration
Content
endpoints_allowed:
        - "https://raw.githubusercontent.com/georges91560/crypto-executor/main/executor.py"
        - "https://raw.githubusercontent.com/georges91560/crypto-sniper-oracle/main/crypto_oracle.py"
        - "https://api.telegram.org/bot*"
      requires_credentials: false
      uses_websocket: false
    security_level: "L2 - System Modification (modifies executor.py + restarts service)"
Confidence
84% confidence
Finding
The skill includes outbound communication to the Telegram API, which creates an external transmission channel from a privileged automation context. Even if intended for notifications, such channels can leak operational details, errors, file paths, or secrets if message content is not tightly controlled.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
The user-facing skill content is written in French ('Ce skill permet...') and continues throughout the document without indicating that another language is available. The policy requires flagging locale or language constraints when a skill effectively forces a specific language without user opt-in or a documented regional justification.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
/workspace/data/bot_config.env

# Permissions automatiquement appliquées
chmod 600 /workspace/data/bot_config.env
# → Lecture réservée à l'utilisateur courant uniquement
# → Jamais visible dans systemctl status ou ps aux
```
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
| Action | Pourquoi |
|---|---|
| `sudo systemctl restart crypto-executor` | Redémarrer le bot après optimisation |
| `sudo systemctl stop/start crypto-executor` | Contrôle du service au setup |
| `pkill -f executor.py` | Fallback si systemd indisponible |
| `crontab -e` | Installer le job récurrent (fallback system cron) |
Confidence
88% confidence
Finding
Documenting sudo systemctl restart as part of routine operation normalizes privileged service control inside the skill workflow. Because the skill changes executable behavior by editing executor.py, this privilege can immediately activate unsafe or malicious code after modification.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
| Action | Pourquoi |
|---|---|
| `sudo systemctl restart crypto-executor` | Redémarrer le bot après optimisation |
| `sudo systemctl stop/start crypto-executor` | Contrôle du service au setup |
| `pkill -f executor.py` | Fallback si systemd indisponible |
| `crontab -e` | Installer le job récurrent (fallback system cron) |
Confidence
88% confidence
Finding
The setup documentation includes sudo stop/start control, further confirming that the skill can manage service lifecycle with elevated privileges. In combination with remote downloads and parameter edits, this creates a straightforward path from file change to privileged execution under persistence.

Session Persistence

Medium
Category
Rogue Agent
Content
| `sudo systemctl restart crypto-executor` | Redémarrer le bot après optimisation |
| `sudo systemctl stop/start crypto-executor` | Contrôle du service au setup |
| `pkill -f executor.py` | Fallback si systemd indisponible |
| `crontab -e` | Installer le job récurrent (fallback system cron) |

---
Confidence
91% confidence
Finding
Installing a cron job creates persistence, allowing the skill to continue executing periodically without a fresh user action. In a skill that edits executable code, handles credentials, and controls process restarts, persistence substantially increases the risk of recurring unauthorized changes or repeated execution after compromise.

Session Persistence

Medium
Category
Rogue Agent
Content
```bash
openclaw cron remove --name crypto-executor-optimizer
# OU
crontab -e  # supprimer la ligne crypto-executor-optimizer
```

---
Confidence
85% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The script transmits optimization status and the free-form REASON field to Telegram, an external third-party service unrelated to the core file-edit/validation task. In a trading optimizer context, those messages can leak operational details, strategy rationale, failure states, and potentially sensitive business information outside the local environment.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The script consumes Telegram credentials from environment variables and uses them for outbound requests without clear disclosure in the skill description or code comments about external data transfer. Accessing secrets to send data off-host increases exposure and can surprise operators who expect a local optimizer only.

External Transmission

Medium
Category
Data Exfiltration
Content
# Telegram alert
    if [ -n "$TELEGRAM_BOT_TOKEN" ] && [ -n "$TELEGRAM_CHAT_ID" ]; then
        MSG="⚠️ Wesley Optimizer: syntax error in generated code. Original restored.%0AReason: $REASON"
        curl -s -X POST "https://api.telegram.org/bot$TELEGRAM_BOT_TOKEN/sendMessage" \
            -d "chat_id=$TELEGRAM_CHAT_ID&text=$MSG" > /dev/null
    fi
    exit 1
Confidence
90% confidence
Finding
Hardcoding use of the Telegram API domain establishes an explicit external egress dependency in a script whose primary purpose is local file modification and process control. In this context, that external communication path is more dangerous because the optimizer handles strategy-related inputs and state.

External Transmission

Medium
Category
Data Exfiltration
Content
# Telegram alert
    if [ -n "$TELEGRAM_BOT_TOKEN" ] && [ -n "$TELEGRAM_CHAT_ID" ]; then
        MSG="⚠️ Wesley Optimizer: syntax error in generated code. Original restored.%0AReason: $REASON"
        curl -s -X POST "https://api.telegram.org/bot$TELEGRAM_BOT_TOKEN/sendMessage" \
            -d "chat_id=$TELEGRAM_CHAT_ID&text=$MSG" > /dev/null
    fi
    exit 1
Confidence
90% confidence
Finding
Hardcoding use of the Telegram API domain establishes an explicit external egress dependency in a script whose primary purpose is local file modification and process control. In this context, that external communication path is more dangerous because the optimizer handles strategy-related inputs and state.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
This code restarts the crypto-executor service via systemd and, on fallback, kills matching executor.py processes before launching a new one. Although actions are logged, there is no confirmation prompt or explicit safety warning near the restart logic, and these operations can disrupt a running trading bot and alter system state.

Static analysis

No suspicious patterns detected.