ClawHub
Back to skill

Security audit

Safe Skills

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent crypto-wallet API helper, but it gives an agent broad ability to move funds or send contract transactions without mandatory user approval safeguards.

Review this skill carefully before installing. Only use it in a trusted environment, pin the SafeSkills API and frontend URLs to known trusted hosts, treat the returned API key like a wallet signing credential, and require explicit user approval with full transaction details before any transfer or contract interaction.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:9
Finding

Environment-Controlled API Endpoint Can Expose the Wallet Bearer Token

Content
View full analysis
" \ -H "Content-Type: application/json" \ -d '{ "to": "0xContractAddress", "data": "0xCalldata", "value": "0" }' ``` ### Technical Analysis The skill instructs the agent to trust `SAFESKILLS_API_URL` as the destination for authenticated requests without validating the URL scheme or hostname. Every subsequent wallet operation transmits the bearer API key to the configured endpoint. If the environment variable is attacker-controlled, inherited from an untrusted runtime, or incorrectly configured, the agent will send the bearer credential and transaction contents to an unintended server. Because bearer tokens can generally be replayed by whoever possesses them, endpoint substitution can lead directly to account compromise. The same unrestricted override pattern applies to `SAFESKILLS_FRONTEND_URL`. Although the reviewed examples do not attach the bearer token to the frontend URL, an attacker-controlled frontend could still be used for phishing or deceptive wallet-policy management if presented to the user. ### Attack Path 1. An attacker, compromised launcher, or untrusted runtime configuration sets `SAFESKILLS_API_URL` to an attacker-controlled HTTPS endpo ...[truncated 902 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:71
Finding

Financial Operations Lack a Mandatory User-Confirmation Boundary

Content
View full analysis
" \ -H "Content-Type: application/json" \ -d '{ "to": "0xRecipientAddress", "amount": "0.01" }' # Transfer ERC-20 token curl -X POST "${SAFESKILLS_API_URL:-https://safeskill-production.up.railway.app}/api/skills/evm-wallet/transfer" \ -H "Authorization: Bearer " \ -H "Content-Type: application/json" \ -d '{ "to": "0xRecipientAddress", "amount": "100", "token": "0xTokenContractAddress" }' ``` ```bash curl -X POST "${SAFESKILLS_API_URL:-https://safeskill-production.up.railway.app}/api/skills/evm-wallet/send-transaction" \ -H "Authorization: Bearer " \ -H "Content-Type: application/json" \ -d '{ "to": "0xContractAddress", "data": "0xCalldata", "value": "0" }' ``` The policy-related instruction is only conditional: ```markdown - If a transfer or transaction fails, check that the wallet has sufficient balance and that any required policies have been approved by the user via the claim URL. ``` ### Technical Analysis The skill gives the agent access to asset-transfer and arbitrary-calldata endpoints but does not require explicit user confirmation before execution. It also does not require destination verification, chain verification, calldata decoding, transaction simulation, fee review, spending limits, or contract allowlisting. The arbitrary transaction endpoint is especially sensitive because calldata can invoke unrestricted contract methods. Depending on the target contract, a transaction with zero native value may still approve token allowances, transfe ...[truncated 1660 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

Create an EVM wallet secret. Store the returned API key for all subsequent calls. Share the claim URL with the user so they can manage policies for the wallet.

bash
curl -X POST "${SAFESKILLS_API_URL:-https://safeskill-production.up.railway.app}/api/secrets" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "EVM_WALLET",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill provides direct instructions for transferring funds and sending arbitrary blockchain transactions, but it does not require explicit user confirmation, transaction preview, recipient verification, or a financial-risk warning before irreversible actions. In an agent context, this is dangerous because a downstream agent could autonomously execute value-bearing operations or contract interactions based on ambiguous, injected, or mistaken prompts, leading to permanent loss of funds or approval of malicious contract behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.