ClawHub
Back to skill

Security audit

Bountyswarm

Security checks for vulnerabilities and agentic risk

Overview

This skill appears purpose-built for a USDC bounty platform, but it can trigger high-impact financial actions without enough documented confirmation, reversibility, or privacy guidance.

Review this skill carefully before installing. Use only with a backend and contracts you trust, verify the network, contract addresses, reward amounts, winner addresses, and fee splits before any action, and avoid putting secrets or private business data in IPFS or public URLs. Prefer pinned package versions if using the optional CLI or SDK examples.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:23
Finding

Unpinned Third-Party npm Package Execution and Installation

Content
View full analysis

Vulnerability Details

File Locations:

  • README.md:23-25
  • references/architecture.md:63-69

Vulnerability Type: Unpinned and dynamically resolved third-party dependencies
Risk Level: Medium

Vulnerable Code

README.md:23-25:

bash
npx bountyswarm --help     # CLI
npm i bountyswarm-sdk       # TypeScript SDK

references/architecture.md:63-69:

bash
# CLI
npx bountyswarm list
npx bountyswarm create --reward 100 --deadline 7d --description "..."

# SDK
npm i bountyswarm-sdk

Technical Analysis

The documentation directs users to execute or install npm packages without specifying an exact, audited version or integrity value.

npx bountyswarm can download the version currently selected by the npm registry and immediately execute its CLI code. Likewise, npm i bountyswarm-sdk dynamically resolves a package release and may execute package lifecycle scripts during installation. No lockfile, integrity hash, reviewed source reference, or lifecycle-script restriction is provided.

Consequently, the code executed by users can change after this skill has been reviewed. The project itself does not contain evidence that the named packages are currently malicious; the vulnerability is the unsafe trust model and mutable supply-chain dependency.

Attack Path

  1. An attacker compromises the npm account, publication token, repository, or build pipeline associated with bountyswarm or bountyswarm-sdk; alternatively, package ownership is transferred to an untrusted party.
  2. The attacker publishes a malicious version under the same package name.
  3. A user follows the documented unpinned npx or npm i command.
  4. npm resolves and downloads the attacker-controlled release.
  5. In the npx case, the package CLI executes immediately. In the installation case, malicious lifecycle scripts may execute during installation, or malicious SDK code executes when imported.
  6. The pa ...[truncated 882 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin every documented package to a reviewed exact version, for example:

    bash
    npx --yes bountyswarm@1.0.0 --help
npm install --save-exact bountyswarm-sdk@1.0.0

  2. Commit and enforce an npm lockfile containing registry-resolved integrity hashes.

  3. Publish links to the packages' verifiable source repositories and associate releases with signed tags or provenance attestations.

  4. Verify package integrity and publisher identity before installation.

  5. Disable lifecycle scripts where they are not required:

    bash
    npm install --ignore-scripts --save-exact bountyswarm-sdk@1.0.0

  6. Prefer installing reviewed dependencies in an isolated, least-privileged environment rather than invoking a dynamically resolved package with npx.

  7. Use dependency monitoring and package allowlists in CI/CD.

  8. Update both README.md and references/architecture.md so all examples consistently use the audited version.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The README advertises creating bounties with USDC escrow but gives no warning that actions may move real funds, incur fees, or be irreversible. In a blockchain/payment context, omission of transactional risk warnings can mislead users into performing financially sensitive operations without understanding confirmation, wallet, network, or recovery implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The README describes winner selection and fee-splitting subcontracting without warning that these operations may trigger irreversible payout allocation or release escrowed funds. Because the skill centers on decentralized bounty distribution, missing warnings make operational mistakes more dangerous and can lead to accidental loss, mispayment, or disputes that cannot be easily reversed.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
85% confidence
Finding

The README instructs users to run npx bountyswarm without a pinned version, which causes execution of whatever package version is current at install time. In a financial skill tied to USDC escrow, this increases supply-chain risk because a malicious or compromised package update could execute arbitrary code or alter transaction flows when users invoke the CLI.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill exposes commands that create bounties with USDC escrow but does not warn users that invoking them can lock real funds on-chain and may incur irreversible blockchain transactions and fees. In an agentic context, a user or agent may treat the command as a routine task action and unintentionally commit assets without understanding the financial consequences.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation for picking a winner omits that this action may trigger irreversible on-chain release of escrowed funds to the selected address. Because the skill is designed for decentralized bounty settlement, an agent or user could finalize payment to the wrong party through a single mistaken command, causing direct financial loss that may not be recoverable.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The documentation instructs users to run npx bountyswarm without pinning a specific package version. npx will fetch the latest published package at execution time, so if the package is later compromised, typosquatted, or updated with malicious code, users could execute attacker-controlled code on their systems. Because this is a quick-start command in an agent-oriented platform, users may copy-paste it directly, increasing exploitability.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

This second quick-start example again uses npx bountyswarm without an explicit version pin, creating the same supply-chain risk. Users following the docs may unknowingly run whatever version is current on npm at that moment, which could be malicious or unreviewed. In the context of a crypto/agent platform that handles escrow and automation, compromise of developer workstations or agent runtime environments is especially concerning.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The create-bounty command states that USDC rewards are locked in escrow, but the manifest omits a clear warning that this is a financial action involving real funds and may be difficult or impossible to reverse. Users could unintentionally commit assets without understanding custody, settlement conditions, fees, or failure scenarios, creating direct monetary risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest instructs users to provide a metadataURI pointing to IPFS or an external URL for full task details, but it gives no warning that these locations may be public, permanent, and accessible to third parties. This can lead to unintended disclosure of sensitive task data, prompts, credentials, or business information if users assume the URI is private.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The submission flow requires a resultURI to the full result via IPFS or URL, yet the manifest does not warn that submission contents may expose proprietary outputs, personal data, or secrets to external parties. Because bounty submissions are central to the skill's purpose, the lack of disclosure guidance materially increases the chance users will publish sensitive results to permanent or public storage.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.