ClawHub
Back to skill

Security audit

Crypto Arbitrage CN | 加密货币套利监控

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward crypto price monitor with expected exchange API calls and optional Telegram alerts, but users should understand the outbound notification behavior before use.

Install only if you want a local script that makes repeated network requests to public exchange APIs. Do not add exchange trading credentials because the skill does not need them. If you enable Telegram, arbitrage opportunity details will be sent through Telegram using your bot token and chat ID, and continuous mode will keep running until stopped.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill advertises executable behavior involving network access and environment-based secrets (for exchange APIs and Telegram) but does not declare any explicit tool scope or permission boundaries. This creates ambiguity about what the agent may access at runtime and increases the risk of over-privileged execution, secret exposure, or unintended outbound requests if the skill is invoked automatically.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The manifest uses very broad trigger phrases such as 'crypto', 'arbitrage', and '价格差', which can match ordinary discussion rather than clear user intent to run this skill. Over-broad routing can cause the skill to activate in unrelated conversations and initiate networked monitoring or prompt for sensitive configuration like Telegram tokens without sufficiently explicit consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
81% confidence
Finding

The skill is branded as "crypto-arb-cn" and the trigger/examples are framed in Chinese, but the file does not state that language selection is optional or user-controlled. This can constitute a locale/language policy issue because the skill appears to default to a specific language without explicit opt-in, even though the rest of the description is bilingual.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/arbitrage_monitor.py (reported line 28)May include surrounding context.

python
EXCHANGES = {
    "binance": {
        "name": "币安",
        "url": "https://api.binance.com/api/v3/ticker/price?symbol={}",
        "fee": 0.001,  # 0.1%
    },
    "okx": {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/arbitrage_monitor.py (reported line 38)May include surrounding context.

python
},
    "gate": {
        "name": "Gate.io",
        "url": "https://api.gateio.ws/api/v4/spot/tickers?currency_pair={}",
        "fee": 0.002,  # 0.2%
    },
    "huobi": {

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/arbitrage_monitor.py (reported line 43)May include surrounding context.

python
},
    "huobi": {
        "name": "火币",
        "url": "https://api.huobi.pro/market/detail/merged?symbol={}",
        "fee": 0.002,  # 0.2%
    },
}

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script emits operational output and Telegram notifications in Chinese only, including status, alerts, and opportunity details. This enforces a specific language without any user opt-in or configurable locale, which matches the stated natural-language policy violation criteria.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/arbitrage_monitor.py (reported line 180)May include surrounding context.

python
try:
            async with aiohttp.ClientSession() as session:
                url = f"https://api.telegram.org/bot{TELEGRAM_BOT_TOKEN}/sendMessage"
                await session.post(url, json={
                    "chat_id": TELEGRAM_CHAT_ID,
                    "text": message,

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

This code sends arbitrage opportunity details to Telegram when environment variables are set, which is a network transmission of user/system-derived data to a third party. Although the feature is marked optional and startup output notes when Telegram is enabled, there is no explicit warning in the file-level usage/docs about external data transmission or privacy implications.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.