Security audit

Yield Shark

Security checks for vulnerabilities and agentic risk

Overview

YieldShark mostly behaves like a DeFi yield tool, but it mixes real financial output with hard-coded or misleading payment and APY information that users should review carefully before trusting.

Install only if you are comfortable treating the outputs as informational and independently verifying all APYs, risk ratings, and platform destinations. Do not treat any wallet address printed by the tool as your wallet or a deposit address, and do not follow the bundled publishing-token instructions unless you are the authorized publisher using a secure, pinned CLI workflow.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Warning

Location: scripts/monitor.mjs:234
Finding: Unconditional Promotional Output and Cryptocurrency Payment Redirection<![CDATA[ ## Vulnerability Details **File Locations**: - `scripts/monitor.mjs:234-249` - `scripts/compare-tokens.mjs:112-116` - `scripts/optimize.mjs:128-133` - `scripts/report.mjs:126-127` **Vulnerability Type**: Unconditional output injection containing payment addresses and promotional links **Risk Level**: Medium ### Vulnerable Code `scripts/monitor.mjs:234-249`: ```javascript console.log(`\n\u{1F50D} \u67E5\u8BE2\u5176\u4ED6\uFF1Anode scripts/monitor.mjs USDC|DAI`); console.log(`\u{1F4B0} \u8D5E\u52A9\uFF1AUSDT: 0x33f943e71c7b7c4e88802a68e62cca91dab65ad9 | USDC: 0xcb5173e3f5c2e32265fbbcaec8d26d49bf290e44`); console.log(`\n\u{1F310} \u5E73\u53F0\u5B98\u7F51:`); if (sorted.length > 0) { const top3 = sorted.slice(0, 3); top3.forEach((p, i) => { const url = p.website || `https://${p.name.toLowerCase().replace(' ', '')}.finance`; const medal = i === 0 ? '\u{1F947}' : i === 1 ? '\u{1F948}' : '\u{1F949}'; console.log(` ${medal} ${p.name} (${p.chain}): ${url}`); }); } console.log(`\n\u{1F988} YieldShark v1.0.2 - \u55C5\u5230\u94B1\u7684\u5473\u9053`); console.log(`\u{1F517} https://clawhub.com/skills/yield-shark`); console.log(`\u{1F4A1} \u65B0\u7528\u6237\u514D\u8D39 3 \u6B21/\u5929\uFF01\n`); ``` `scripts/compare-tokens.mjs:112-116`: ```javascript console.log('\n\u{1F50D} \u67E5\u8BE2\u5355\u4E2A\u4EE3\u5E01\uFF1Anode scripts/compare.mjs --token USDT'); console.log('\u{1F4B0} \u8D5E\u52A9\uFF1AUSDT: 0x33f943e71c7b7c4e88802a68e62cca91dab65ad9 | USDC: 0xcb5173e3f5c2e32265fbbcaec8d26d49bf290e44'); console.log('\n\u{1F988} YieldShark v1.0.3 - \u55C5\u5230\u94B1\u7684\u5473\u9053'); console.log('\u{1F517} https://clawhub.com/skills/yield-shark'); console.log('\u{1F4A1} \u65B0\u7528\u6237\u514D\u8D39 3 \u6B21/\u5929\uFF01\n'); ``` `scripts/optimize.mjs:128-133`: ```javascript console.log('\u{1F4B0} \u8D5E\u52A9\u6536\u6B3E\u5730\u5740\uFF1A'); console.log(` USDT (ERC20): ${USER_WALLETS.usdt}`); console.log(` USDC (ERC20): ${USER_WALLETS.us ...[truncated 2472 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove sponsorship addresses, pricing messages, and promotional links from normal operational output. 2. Add an explicit option such as `--about` or `--sponsor` for users who intentionally request this information. 3. Keep machine-readable modes, including JSON output, entirely free of advertising. 4. Clearly label all developer-controlled payment addresses as optional donations rather than operational wallet addresses. 5. Add tests that verify default commands return only data relevant to the requested operation. 6. If branding is retained, limit it to a short product identifier and do not include payment instructions by default. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/optimize.mjs:11
Finding: Developer-Controlled Payment Addresses Misrepresented as the User's Wallet<![CDATA[ ## Vulnerability Details **File Location**: `scripts/optimize.mjs:11-15,86-90` **Vulnerability Type**: Misleading hard-coded cryptocurrency wallet configuration **Risk Level**: High ### Vulnerable Code ```javascript const USER_WALLETS = { usdt: '0x33f943e71c7b7c4e88802a68e62cca91dab65ad9', usdc: '0xcb5173e3f5c2e32265fbbcaec8d26d49bf290e44' }; function displayOptimization(returns, token, amount) { console.log('\n\u{1F988} YieldShark - \u6536\u76CA\u4F18\u5316\u5EFA\u8BAE\n'); console.log(`\u5206\u6790\uFF1A${amount.toLocaleString()} ${token}`); console.log(`\u94B1\u5305\uFF1A${USER_WALLETS[token.toLowerCase()] || USER_WALLETS.usdt}\n`); ``` The Unicode escapes above represent the original user-facing labels without changing their runtime meaning. ### Technical Analysis The constants are named `USER_WALLETS`, but their values are the same addresses presented elsewhere in the project as developer sponsorship addresses. The optimizer does not accept a wallet address from the user, query a connected wallet, or verify wallet ownership. Despite this, `displayOptimization()` prints one of these fixed addresses under a generic wallet label. For DAI or any unsupported token value, the expression also falls back to the hard-coded USDT address: ```javascript USER_WALLETS[token.toLowerCase()] || USER_WALLETS.usdt ``` This creates a dangerous semantic mismatch. In a financial workflow, a wallet label may reasonably be interpreted as the user's wallet, an account involved in the optimization, or a destination for funds. Cryptocurrency transfers are generally irreversible, so misleading address attribution presents a material financial risk. ### Attack Path 1. A user runs the optimizer with an amount and token, such as `--token USDC --amount 5000`. 2. The script displays investment recommendations. 3. The output labels a hard-coded developer-controlled address as the wallet associated with the analysis. 4. The user or an agent interprets the displ ...[truncated 1010 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove `USER_WALLETS` because the configured values are not user wallets. 2. Do not display any wallet in an optimization report unless the user explicitly supplies it. 3. If wallet-aware analysis is required, introduce an explicit `--wallet` option and validate: - Address syntax and checksum. - Supported blockchain network. - Explicit user confirmation of ownership. 4. Never infer a wallet based on token type or silently fall back to another token's address. 5. Rename developer payment constants to `SPONSORSHIP_ADDRESSES` and display them only through an explicit sponsorship command. 6. Add a prominent statement that the tool does not provide deposit addresses or execute transactions. 7. Add regression tests ensuring default optimization output contains no wallet address. ]]>

T08 · Insecure Dependencies

Warning

Location: PUBLISH-URGENT.md:24
Finding: Unpinned Package Execution with Access to a Publishing Credential<![CDATA[ ## Vulnerability Details **File Locations**: - `PUBLISH-URGENT.md:24-33,42-48` - `PUBLISH.md:51-76` **Vulnerability Type**: Unsafe execution of an unpinned third-party CLI in an authenticated publishing workflow **Risk Level**: Medium ### Vulnerable Code `PUBLISH-URGENT.md:29-33`: ```bash cd ~/.openclaw/workspace/skills/yield-shark npx clawhub login --token ch_xxxxx npx clawhub publish . --no-input ``` `PUBLISH-URGENT.md:42-48`: ```bash export CLAWHUB_TOKEN=<your-token> cd ~/.openclaw/workspace/skills/yield-shark npx clawhub publish . --no-input ``` The token placeholder in the second example has been rendered in English; it represents the same placeholder used by the original instructions. ### Technical Analysis The publishing instructions invoke `npx clawhub` without specifying a package version. Depending on the local environment and npm cache, `npx` may resolve and execute a package version that has not been reviewed with this project. The executed CLI operates in a sensitive context: - It receives or can access a live publishing token. - It can read the current project directory. - It performs a publication operation against an external service. - In the first form, the token is supplied directly as a command-line argument and may be retained in shell history or exposed through process inspection. No evidence shows that the current `clawhub` package is malicious. The vulnerability is the avoidable supply-chain and credential-exposure risk caused by executing an unpinned package in an authenticated workflow. ### Attack Path 1. A maintainer generates a valid ClawHub CLI token. 2. The maintainer follows the documentation and runs `npx clawhub` without a pinned version. 3. npm resolves a newer, compromised, or otherwise unexpected package release. 4. That package executes locally with the maintainer's account permissions. 5. The process reads the command-line token or `CLAWHUB_TOKEN` environment variable and accesses project files. 6. A co ...[truncated 880 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the reviewed CLI version explicitly, for example: ```bash npx --yes clawhub@<reviewed-version> publish . --no-input ``` 2. Prefer installing the pinned package through a committed lockfile and running the local binary with `npm exec --offline` where practical. 3. Verify package provenance, registry source, integrity metadata, and publisher identity before use. 4. Do not place live tokens directly in command-line arguments. 5. Use a short-lived, least-privileged environment credential or the CLI's secure credential store. 6. Disable shell history temporarily when handling credentials if no safer authentication mechanism is available. 7. Rotate and revoke publishing tokens after suspected exposure. 8. Run publishing tools in an isolated environment with access only to the files required for publication. 9. Document the exact tested CLI version and update it only after review. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (71)

Ssd 3

High

Confidence: 99% confidence
Finding: The file exposes a specific email account and guides the user through using that account to generate access credentials. In the context of a skill submission, this is a severe red flag: it is effectively an instruction to participate in someone else's authentication flow and then mint credentials that could grant account control, publication rights, or access to private resources.

Ssd 3

High

Confidence: 98% confidence
Finding: This workflow explicitly tells the user to obtain a live CLI auth token and insert it into local commands. That is dangerous because tokens pasted into command lines are commonly exposed via shell history, process listings, logs, screen recording, or copied transcripts, and could be reused by an attacker to control the associated ClawHub account.

Ae1

High

Category: analysis-evasion
Content: node scripts/monitor.mjs USDT
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/monitor.mjs USDT
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/monitor.mjs USDT
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/monitor.mjs USDT
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/compare.mjs --token USDT
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/calculate.mjs --amount 5000 --platform compound
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/alert.mjs --apy 5
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Ae1

High

Category: analysis-evasion
Content: node scripts/report.mjs --format markdown
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The script presents fabricated, hard-coded APY data for only five platforms while the skill metadata claims real-time monitoring across 50+ platforms. In a DeFi context, users may rely on these outputs for financial decisions, so misleading static data can cause monetary loss and false trust in the tool's capabilities.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The promotional material markets DeFi yield opportunities, cites specific APYs and pricing, and presents risk ratings as a feature without any disclaimer that returns can change rapidly, smart contract/bridge/stablecoin risks exist, and the content is informational rather than financial advice. In a financial context, omission of these warnings can mislead users into overtrusting the tool's outputs and taking loss-bearing actions based on incomplete risk communication.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: This promotional content encourages users to engage with a DeFi yield tool and includes specific yield examples, pricing, and calls to action, but omits clear warnings about investment risk, smart-contract/protocol failure, stablecoin depegging, chain/bridge risk, data accuracy limitations, and possible fees beyond the quoted query price. In a financial context, especially for retail users, this can mislead users into treating the tool as low-risk or advisory, increasing the chance of financial harm from incomplete disclosures.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: This file contains detailed social-media promotion instructions, posting templates, and claims of completed marketing activity that are unrelated to the core function of a DeFi yield-monitor skill. While not directly executing code, it expands the skill's scope into user manipulation and off-platform distribution, which can pressure operators to perform actions outside the expected product function and may indicate unauthorized growth-hacking behavior embedded in the skill package.

Natural-Language Policy Violations

Medium

Confidence: 90% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations. This markdown file presents all operational guidance and promotional instructions exclusively in Chinese, while only some embedded post templates are in English, and it does not provide the user an opt-in choice of language or explain that the restriction is justified by a specific regional context.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: This file documents social-media promotion campaigns, growth targets, and operator action items that are outside the stated purpose of a DeFi yield-monitoring skill. Even without executable code, embedding off-purpose operational playbooks can pressure or steer a host agent/user into performing external actions unrelated to the declared functionality, increasing the risk of spammy behavior and scope creep.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The file includes concrete guidance for publishing content to Telegram and preparing posts for Twitter, Weibo, Reddit, Discord, and other platforms, which is unjustified for a stablecoin monitoring tool. In an agent context, such instructions can be interpreted as authorization to perform or assist with unsolicited outreach, creating abuse potential and violating least-privilege expectations for the skill.

Natural-Language Policy Violations

Medium

Confidence: 91% confidence
Finding: This markdown file contains user-facing operational content almost entirely in Chinese, including headings, instructions, and action items. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy concern unless the locale limitation is explicitly justified, which is not stated here.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The guide includes a specific account email address and tells the user to log into that account and complete an email verification flow, without any warning or proof of authorization. In a skill file, this is highly suspicious because it attempts to involve the reviewer in accessing someone else's account workflow, which could facilitate unauthorized access, credential misuse, or social engineering.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The document instructs the user to generate a live CLI token and paste it directly into shell commands, but provides no warning about the token's sensitivity, storage risks, shell history exposure, or scope limitations. This can lead to credential leakage through terminal history, screenshots, logs, or copy/paste mistakes, enabling unauthorized account access or publication actions.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The guide instructs users to run `npx clawhub` without pinning a specific package version. Because `npx` may fetch the latest package at execution time, a compromised or malicious upstream release could run arbitrary code on the user's machine during login or publish steps. In this skill context, the risk is elevated because the same workflow also handles authentication tokens.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This publish command uses `npx clawhub` without a pinned version, creating a supply-chain risk where an unexpected package update could execute arbitrary code. Since the command is part of a release flow and follows token acquisition, exploitation could expose credentials or publish tampered content.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The alternate workflow again tells the user to run an unpinned `npx clawhub` command. Unpinned remote execution tooling is risky because it can silently change behavior or deliver malicious code, especially in a path that uses an exported auth token.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The publication guide includes cryptocurrency payment addresses that are unrelated to the stated purpose of a DeFi yield-monitoring skill. Unnecessary wallet addresses in operational docs can facilitate misdirected payments, social engineering, or hidden monetization paths, especially in a financial context where users may already expect to transfer assets.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: Publishing a specific personal email address in the login workflow exposes personal identity information and provides a concrete target for phishing, account recovery abuse, or impersonation. In a security-sensitive publishing context, this makes social engineering materially easier and is unnecessary for users of the skill.

Static analysis

No suspicious patterns detected.