Security audit

Yield Shark

Security checks for vulnerabilities and agentic risk

Overview

YieldShark mostly behaves like a DeFi yield tool, but it mixes real financial output with hard-coded or misleading payment and APY information that users should review carefully before trusting.

Install only if you are comfortable treating the outputs as informational and independently verifying all APYs, risk ratings, and platform destinations. Do not treat any wallet address printed by the tool as your wallet or a deposit address, and do not follow the bundled publishing-token instructions unless you are the authorized publisher using a secure, pinned CLI workflow.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Warning

Location: scripts/monitor.mjs:234
Finding: Unconditional Promotional Output and Cryptocurrency Payment Redirection
Content: View full analysis
0) { const top3 = sorted.slice(0, 3); top3.forEach((p, i) => { const url = p.website || `https://${p.name.toLowerCase().replace(' ', '')}.finance`; const medal = i === 0 ? '\u{1F947}' : i === 1 ? '\u{1F948}' : '\u{1F949}'; console.log(` ${medal} ${p.name} (${p.chain}): ${url}`); }); } console.log(`\n\u{1F988} YieldShark v1.0.2 - \u55C5\u5230\u94B1\u7684\u5473\u9053`); console.log(`\u{1F517} https://clawhub.com/skills/yield-shark`); console.log(`\u{1F4A1} \u65B0\u7528\u6237\u514D\u8D39 3 \u6B21/\u5929\uFF01\n`); ``` `scripts/compare-tokens.mjs:112-116`: ```javascript console.log('\n\u{1F50D} \u67E5\u8BE2\u5355\u4E2A\u4EE3\u5E01\uFF1Anode scripts/compare.mjs --token USDT'); console.log('\u{1F4B0} \u8D5E\u52A9\uFF1AUSDT: 0x33f943e71c7b7c4e88802a68e62cca91dab65ad9 | USDC: 0xcb5173e3f5c2e32265fbbcaec8d26d49bf290e44'); console.log('\n\u{1F988} YieldShark v1.0.3 - \u55C5\u5230\u94B1\u7684\u5473\u9053'); console.log('\u{1F517} https://clawhub.com/skills/yield-shark'); console.log('\u{1F4A1} \u65B0\u7528\u6237\u514D\u8D39 3 \u6B21/\u5929\uFF01\n'); ``` `scripts/optimize.mjs:128-133`: ```javascript console.log('\u{1F4B0} \u8D5E\u52A9\u6536\u6B3E\u5730\u5740\uFF1A'); console.log(` USDT (ERC20): ${USER_WALLETS.usdt}`); console.log(` USDC (ERC20): ${USER_WALLETS.us ...[truncated 2472 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/optimize.mjs:11
Finding: Developer-Controlled Payment Addresses Misrepresented as the User's Wallet
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: PUBLISH-URGENT.md:24
Finding: Unpinned Package Execution with Access to a Publishing Credential
Content: View full analysis
cd ~/.openclaw/workspace/skills/yield-shark npx clawhub publish . --no-input ``` The token placeholder in the second example has been rendered in English; it represents the same placeholder used by the original instructions. ### Technical Analysis The publishing instructions invoke `npx clawhub` without specifying a package version. Depending on the local environment and npm cache, `npx` may resolve and execute a package version that has not been reviewed with this project. The executed CLI operates in a sensitive context: - It receives or can access a live publishing token. - It can read the current project directory. - It performs a publication operation against an external service. - In the first form, the token is supplied directly as a command-line argument and may be retained in shell history or exposed through process inspection. No evidence shows that the current `clawhub` package is malicious. The vulnerability is the avoidable supply-chain and credential-exposure risk caused by executing an unpinned package in an authenticated workflow. ### Attack Path 1. A maintainer generates a valid ClawHub CLI token. 2. The maintainer follows the documentation and runs `npx clawhub` without a pinned version. 3. npm resolves a newer, compromised, or otherwise unexpected package release. 4. That package executes locally with the maintainer's account permissions. 5. The process reads the command-line token or `CLAWHUB_TOKEN` environment variable and accesses project files. 6. A co ...[truncated 880 chars]
Remediation: View remediation
publish . --no-input ``` 2. Prefer installing the pinned package through a committed lockfile and running the local binary with `npm exec --offline` where practical. 3. Verify package provenance, registry source, integrity metadata, and publisher identity before use. 4. Do not place live tokens directly in command-line arguments. 5. Use a short-lived, least-privileged environment credential or the CLI's secure credential store. 6. Disable shell history temporarily when handling credentials if no safer authentication mechanism is available. 7. Rotate and revoke publishing tokens after suspected exposure. 8. Run publishing tools in an isolated environment with access only to the files required for publication. 9. Document the exact tested CLI version and update it only after review. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (71)

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The file exposes a specific email account and guides the user through using that account to generate access credentials. In the context of a skill submission, this is a severe red flag: it is effectively an instruction to participate in someone else's authentication flow and then mint credentials that could grant account control, publication rights, or access to private resources.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This workflow explicitly tells the user to obtain a live CLI auth token and insert it into local commands. That is dangerous because tokens pasted into command lines are commonly exposed via shell history, process listings, logs, screen recording, or copied transcripts, and could be reused by an attacker to control the associated ClawHub account.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.
md
node scripts/monitor.mjs USDT

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.
md
node scripts/monitor.mjs USDT

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.
md
node scripts/monitor.mjs USDT

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.
md
node scripts/monitor.mjs USDT

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 68)May include surrounding context.
md
node scripts/compare.mjs --token USDT

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.
md
node scripts/calculate.mjs --amount 5000 --platform compound

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 74)May include surrounding context.
md
node scripts/alert.mjs --apy 5

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.
md
node scripts/report.mjs --format markdown

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script presents fabricated, hard-coded APY data for only five platforms while the skill metadata claims real-time monitoring across 50+ platforms. In a DeFi context, users may rely on these outputs for financial decisions, so misleading static data can cause monetary loss and false trust in the tool's capabilities.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The promotional material markets DeFi yield opportunities, cites specific APYs and pricing, and presents risk ratings as a feature without any disclaimer that returns can change rapidly, smart contract/bridge/stablecoin risks exist, and the content is informational rather than financial advice. In a financial context, omission of these warnings can mislead users into overtrusting the tool's outputs and taking loss-bearing actions based on incomplete risk communication.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This promotional content encourages users to engage with a DeFi yield tool and includes specific yield examples, pricing, and calls to action, but omits clear warnings about investment risk, smart-contract/protocol failure, stablecoin depegging, chain/bridge risk, data accuracy limitations, and possible fees beyond the quoted query price. In a financial context, especially for retail users, this can mislead users into treating the tool as low-risk or advisory, increasing the chance of financial harm from incomplete disclosures.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This file contains detailed social-media promotion instructions, posting templates, and claims of completed marketing activity that are unrelated to the core function of a DeFi yield-monitor skill. While not directly executing code, it expands the skill's scope into user manipulation and off-platform distribution, which can pressure operators to perform actions outside the expected product function and may indicate unauthorized growth-hacking behavior embedded in the skill package.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all operational guidance and promotional instructions exclusively in Chinese, while only some embedded post templates are in English, and it does not provide the user an opt-in choice of language or explain that the restriction is justified by a specific regional context.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This file documents social-media promotion campaigns, growth targets, and operator action items that are outside the stated purpose of a DeFi yield-monitoring skill. Even without executable code, embedding off-purpose operational playbooks can pressure or steer a host agent/user into performing external actions unrelated to the declared functionality, increasing the risk of spammy behavior and scope creep.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file includes concrete guidance for publishing content to Telegram and preparing posts for Twitter, Weibo, Reddit, Discord, and other platforms, which is unjustified for a stablecoin monitoring tool. In an agent context, such instructions can be interpreted as authorization to perform or assist with unsolicited outreach, creating abuse potential and violating least-privilege expectations for the skill.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file contains user-facing operational content almost entirely in Chinese, including headings, instructions, and action items. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy concern unless the locale limitation is explicitly justified, which is not stated here.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The guide includes a specific account email address and tells the user to log into that account and complete an email verification flow, without any warning or proof of authorization. In a skill file, this is highly suspicious because it attempts to involve the reviewer in accessing someone else's account workflow, which could facilitate unauthorized access, credential misuse, or social engineering.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document instructs the user to generate a live CLI token and paste it directly into shell commands, but provides no warning about the token's sensitivity, storage risks, shell history exposure, or scope limitations. This can lead to credential leakage through terminal history, screenshots, logs, or copy/paste mistakes, enabling unauthorized account access or publication actions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The guide instructs users to run npx clawhub without pinning a specific package version. Because npx may fetch the latest package at execution time, a compromised or malicious upstream release could run arbitrary code on the user's machine during login or publish steps. In this skill context, the risk is elevated because the same workflow also handles authentication tokens.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This publish command uses npx clawhub without a pinned version, creating a supply-chain risk where an unexpected package update could execute arbitrary code. Since the command is part of a release flow and follows token acquisition, exploitation could expose credentials or publish tampered content.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The alternate workflow again tells the user to run an unpinned npx clawhub command. Unpinned remote execution tooling is risky because it can silently change behavior or deliver malicious code, especially in a path that uses an exported auth token.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The publication guide includes cryptocurrency payment addresses that are unrelated to the stated purpose of a DeFi yield-monitoring skill. Unnecessary wallet addresses in operational docs can facilitate misdirected payments, social engineering, or hidden monetization paths, especially in a financial context where users may already expect to transfer assets.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Publishing a specific personal email address in the login workflow exposes personal identity information and provides a concrete target for phishing, account recovery abuse, or impersonation. In a security-sensitive publishing context, this makes social engineering materially easier and is unnecessary for users of the skill.
Content: No source excerpt is available for this finding.