ClawHub
Back to skill

Security audit

Crypto Radar

Security checks for vulnerabilities and agentic risk

Overview

This is a read-only crypto market lookup skill whose network use is purpose-aligned, though it should better disclose all data sources and Chinese-language scope.

Install only if you are comfortable with the skill making live requests to Yahoo Finance, CoinGecko, and Binance for public market data. Expect Chinese-language output and crypto-market commentary, including DXY/VIX macro context; the publisher should update the description to disclose those details clearly.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared description mostly matches the core crypto行情 functionality: it does retrieve BTC/ETH and other crypto prices from Yahoo Finance and market cap/volume from CoinGecko. However, the code materially exceeds the stated scope in two notable ways. First, it uses Binance as a third fallback data source, जबकि描述 explicitly says dual data sources (Yahoo Finance + CoinGecko). Second, it pulls non-crypto macro indicators (DXY美元指数 and VIX恐慌指数) and emits interpretive macro commentary about crypto pressure/risk appetite, which is not mentioned in the declared purpose. These are substantive undeclared capabilities/resources rather than mere implementation details, so this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill includes Python code that makes outbound network requests but does not declare any tool scope or allowed-tools boundary in the skill manifest. That creates an authorization and transparency gap: the runtime may permit external access that users or reviewers were not clearly told about, increasing the risk of unexpected data egress or future capability creep.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger phrases are broad enough to activate on common conversation about crypto, which can cause the skill to run unexpectedly and initiate external requests when the user did not clearly ask for a market lookup. In a networked skill, overbroad activation expands the surface for unintended data sharing, unnecessary tool use, and misleading context injection.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill metadata and title are written entirely in Chinese and the description instructs usage based on Chinese trigger phrases, with no indication that other languages are supported or that Chinese is an intentional, documented locale restriction. This can violate language-choice policy when a skill implicitly forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The skill sends outbound requests to a third-party API, which is an external data transmission path. Even if the current request only contains static market IDs, any network egress to undeclared or insufficiently governed third parties introduces privacy, integrity, and supply-chain risk, especially if future changes include user-derived parameters.

Content

Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.

md
def get_crypto_markets():
    ids = "bitcoin,ethereum,solana,binancecoin,ripple,cardano,dogecoin"
    url = f"https://api.coingecko.com/api/v3/coins/markets?vs_currency=usd&ids={ids}&order=market_cap_desc&per_page=10&sparkline=false&price_change_percentage=24h"
    r = requests.get(url, headers={"User-Agent": "Mozilla/5.0"}, timeout=10)
    return r.json()
    # 返回: price, market_cap, total_volume, price_change_percentage_24h

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This file contains natural-language output and documentation that force a specific language/locale for all users. The policy allows locale constraints only when users are given a choice or the restriction is clearly documented and justified, neither of which appears here.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/crypto_spot.py (reported line 95)May include surrounding context.

python
}
    try:
        # Binance 组合行情 API（单个请求获取多个symbol）
        url = "https://api.binance.com/api/v3/ticker/24hr"
        r = requests.get(url, headers=headers, timeout=10)
        if r.status_code != 200:
            raise ValueError(f"Binance {r.status_code}")

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/crypto_spot.py (reported line 122)May include surrounding context.

python
def get_coingecko_markets():
    """CoinGecko 获取市值和交易量"""
    ids = ",".join(COINGECKO_IDS.values())
    url = (f"https://api.coingecko.com/api/v3/coins/markets"
           f"?vs_currency=usd&ids={ids}&order=market_cap_desc"
           f"&per_page=10&sparkline=false&price_change_percentage=24h")
    try:

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest description scopes the skill to cryptocurrency price/market monitoring via Yahoo Finance and CoinGecko. In addition to crypto assets, the code defines MACRO_SYMBOLS and later retrieves and analyzes DXY and VIX, adding broader macro-market commentary that is not described in the manifest.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest explicitly says the skill uses Yahoo Finance and CoinGecko as its data sources. The implementation adds get_binance_prices as a third fallback provider and invokes it when other sources fail, which exceeds the described behavior even if read-only.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.