ClawHub
Back to skill

Security audit

Alchemy Web3

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate Alchemy blockchain query skill, but it needs Review because its script executes a shared .env file and its agent docs encourage persistent or automated financial actions without safeguards.

Install only if you are comfortable with Alchemy receiving the blockchain identifiers you query. Do not let agents use the transaction, auto-bid, or trade examples without explicit human approval and strict limits. Prefer passing ALCHEMY_API_KEY through a controlled process environment instead of a shared sourced .env file, and restrict chain values to known Alchemy chain IDs.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/alchemy.sh:7
Finding

Shared Credential File Is Executed as Shell Code

Content
View full analysis

Vulnerability Details

File Location: scripts/alchemy.sh:7-8
Vulnerability Type: Unsafe sourcing of a shared credential file
Risk Level: Medium

Vulnerable Code

bash
# Load environment
[ -f "$HOME/.openclaw/.env" ] && source "$HOME/.openclaw/.env"

Technical Analysis

The script uses the Bash source command to load ~/.openclaw/.env. Contrary to parsing a data-only environment file, source executes the entire file as shell code in the current process. Any command substitution, function definition, redirection, or arbitrary command present in that file therefore runs whenever the Alchemy CLI is invoked.

The Skill only needs the ALCHEMY_API_KEY and optional ALCHEMY_CHAIN values. Executing all content in a shared file exceeds the minimum privileges necessary for that purpose and creates a local trust-boundary violation. The risk is heightened because the path is shared across OpenClaw components rather than being a dedicated, strictly validated configuration file for this Skill.

Exploitation requires an attacker, compromised Skill, or other local process to gain write access to ~/.openclaw/.env. The code does not itself grant such access, so this is not an independent remote-code-execution vulnerability.

Attack Path

  1. A malicious or compromised local component obtains write access to ~/.openclaw/.env.

  2. It inserts a shell payload, for example:

    bash
    ALCHEMY_API_KEY=expected_value
arbitrary_attacker_command

  3. A user or Agent invokes scripts/alchemy.sh.

  4. Line 8 sources the complete file.

  5. The injected command executes with the same OS identity, environment, filesystem access, and network permissions as the invoking Agent or user.

Impact Assessment

Successful exploitation permits arbitrary command execution under the account running the Skill. The attacker could access files available to that account, read environment variables, alter workspace data, initiate network requests, or ...[truncated 471 chars]

Remediation
View remediation

Remediation Suggestions

  1. Prefer requiring ALCHEMY_API_KEY and ALCHEMY_CHAIN to be supplied through the process environment. Remove automatic sourcing entirely:

    bash
    API_KEY="${ALCHEMY_API_KEY:-}"
CHAIN="${ALCHEMY_CHAIN:-eth-mainnet}"

  2. If file-based configuration is required, use a dedicated Skill-specific file rather than a shared OpenClaw environment file.

  3. Parse only explicitly allowlisted keys as data. Do not use source, eval, or command substitution while parsing configuration.

  4. Validate ALCHEMY_CHAIN against a strict allowlist before constructing an endpoint hostname.

  5. Verify that any configuration file is owned by the current user, is not a symbolic link, and has restrictive permissions such as mode 0600. Refuse to load it if these checks fail.

  6. Update SKILL.md:35-41 and the error at scripts/alchemy.sh:64 so documentation no longer recommends an executable shared .env file. Document restrictive permissions and API-key rotation procedures.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (20)

Tp4

High
Category
MCP Tool Poisoning
Confidence
89% confidence
Finding

The code largely matches the declared blockchain-data purpose: it interacts with Alchemy APIs to retrieve balances, tokens, NFTs, transfers, blocks, transactions, and gas data on configurable chains. However, the description explicitly includes webhooks, and there is no webhook creation, management, or retrieval functionality in the supplied code. Additionally, the ENS command is only a rough workaround and not a proper ENS resolution implementation. There are no obvious unrelated or harmful undeclared capabilities beyond normal environment loading and network access needed for the CLI, but the declared scope overstates implemented functionality.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

2. Configure

bash
# Add to ~/.openclaw/.env
ALCHEMY_API_KEY=your_api_key_here

# Optional: Set default chain (defaults to eth-mainnet)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/alchemy.sh (reported line 8)May include surrounding context.

sh
set -e

# Load environment
[ -f "$HOME/.openclaw/.env" ] && source "$HOME/.openclaw/.env"

# Config
API_KEY="${ALCHEMY_API_KEY:-}"

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/alchemy.sh (reported line 64)May include surrounding context.

sh
set -e

# Load environment
[ -f "$HOME/.openclaw/.env" ] && source "$HOME/.openclaw/.env"

# Config
API_KEY="${ALCHEMY_API_KEY:-}"

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill documents shell-based execution and recurring automation but does not declare any explicit tool scope or allowed-tools boundaries. In an agent environment, missing permission scoping can let the runtime grant broader shell access than intended, increasing the blast radius if prompts, downstream scripts, or future changes are abused.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
### 1. Get API Key
1. Sign up at [alchemy.com](https://www.alchemy.com/?utm_source=gizmolab&utm_medium=skill&utm_campaign=alchemy-web3) (free tier available)
2. Create an app for your target chain
3. Copy your API key

> 💡 New to Web3 development? [GizmoLab](https://gizmolab.io?utm_source=alchemy-web3-skill&utm_medium=github&utm_campaign=skill) offers full-stack blockchain development services.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.

bash
# Get ETH balance
curl -X POST "https://eth-mainnet.g.alchemy.com/v2/$ALCHEMY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc": "2.0",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The webhook section instructs users to send blockchain activity to arbitrary HTTP endpoints without warning about privacy, retention, and third-party disclosure risks. Even if the data is on-chain, aggregating wallet activity and related metadata at a user endpoint can expose sensitive behavioral information or leak operational details if the endpoint is insecure.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/agent-workflows.md (reported line 15)May include surrounding context.

md
WHALE="0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045"
DATA_DIR="$HOME/.openclaw/workspace/data/whales"
mkdir -p "$DATA_DIR"

# Get recent transfers
~/.openclaw/workspace/skills/alchemy-web3/scripts/alchemy.sh transfers "$WHALE" --raw > "$DATA_DIR/latest.json"

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The workflow explicitly suggests using gas-price monitoring to decide when to 'execute transaction now' and that an agent may trigger the transaction. That expands the skill from passive blockchain data retrieval into active financial execution, which is materially riskier because transactions are irreversible and can move funds without strong user confirmation or policy controls.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The mint detector says an agent may 'auto-bid' when a new NFT is detected, which crosses from monitoring into autonomous market participation. This is dangerous because automatic bidding can commit funds immediately based on noisy or manipulated signals, with financial loss and irreversible on-chain consequences.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation mentions auto-bidding/trading behavior without any warning that blockchain transactions are financially risky and typically irreversible. Users may copy these examples into agents without understanding that a bad trigger, buggy parser, or manipulated data source can cause immediate loss of funds.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The integration diagram lists 'ACT → alert / trade / report', which normalizes trading as an expected downstream action of this skill. Even as documentation, this broadens perceived capability and can encourage unsafe autonomous fund-moving behavior beyond the stated purpose of interacting with Alchemy data APIs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation exposes eth_sendRawTransaction as a normal API method without any warning that invoking it broadcasts a signed transaction to a blockchain, which can trigger irreversible value transfers or contract interactions. In an agent skill context, a model or user may treat all documented methods as equally safe and accidentally use this state-changing endpoint when only read-only inspection was intended.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The script automatically sources ~/.openclaw/.env, which may contain credentials or other sensitive environment variables, but there is no user-facing notice beyond the missing-key error path. For code files, accessing sensitive environment variables should have some visible disclosure unless clearly documented as expected behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The help text advertises ens <name> as 'Resolve ENS name to address', but cmd_ens calls the NFT ownership endpoint, reads .validAt.blockHash, and never outputs a resolved address. Its inline comments also say it will resolve via eth_call, then 'actually resolve via calling resolver', but no such resolver call is implemented, so the documented intent contradicts the real behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/alchemy.sh (reported line 82)May include surrounding context.

sh
local method="$1"
    local params="$2"
    
    curl -s -X POST "$(get_rpc_url)" \
        -H "Content-Type: application/json" \
        -d "{\"jsonrpc\":\"2.0\",\"method\":\"$method\",\"params\":$params,\"id\":1}"
}

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The rpc_call helper sends requests to Alchemy over the network using a URL that embeds the API key, and many commands also transmit user-provided wallet addresses, ENS names, transaction hashes, or contract identifiers. The code has no confirmation prompt or user-facing disclosure that these inputs are sent to a third-party service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The NFT lookup command sends the owner address to Alchemy's NFT API, which is a network transmission of user-provided data. There is no warning in code comments, help text, or runtime output explaining that these lookups are performed against an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
79% confidence
Finding

The examples save wallet-related monitoring data to local files such as portfolio.json, token-state.json, and dashboard.html, which can expose sensitive financial activity or address associations on a shared system. The markdown presents this persistence as routine but does not warn users about local data retention or visibility.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.