T09 · Insecure Skill Coding Practices
Error
- Location
manifest.json:76- Finding
Security Controls Are Advisory Under the Documented Host-Native Runtime
- Content
View full analysis
- Remediation
View remediation
Security audit
MuHaven RWA Portfolio (rehearsal)
Security checks for vulnerabilities and agentic risk
Overview
The skill is coherent for a MuHaven portfolio agent, but its financial authority is paired with installation and runtime documentation that weakens or overstates its security boundaries.
Install only if you are comfortable with MuHaven, its broker, and the host OpenClaw runtime having user-level execution exposure in the documented host_native setup. Prefer exact pinned runtime and CLI versions, an isolated OS account or container, and read-only mode unless you intend to stage buy, claim, or pause actions.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:155- Finding
Installation Instructions Execute Mutable and Unpinned Global Packages
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (12)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
json "stdio": "manifest_only" }, "secrets": { "storage": "os_keychain", "deny_paste_ui": true, "references": [ {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
json "stdio": "manifest_only" }, "secrets": { "storage": "os_keychain", "deny_paste_ui": true, "references": [ {
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
json "stdio": "manifest_only" }, "secrets": { "storage": "os_keychain", "deny_paste_ui": true, "references": [ {
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The documentation creates a misleading trust boundary by stating the skill 'only talks to the broker over Unix-socket / named-pipe IPC' while the manifest explicitly permits direct egress to https://api.muhaven.app and https://muhaven.app. Users or reviewers may rely on the docs to assume all sensitive flows are broker-mediated, when in reality the skill can directly communicate with remote MuHaven infrastructure, increasing the risk of unnoticed data transmission or architectural misunderstandings.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
- Content
json "@muhaven/mcp": "0.1.2" }, "devDependencies": { "@types/node": "^22.0.0", "rimraf": "^5.0.0", "tsup": "^8.5.1", "tsx": "^4.21.0",
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
- Content
json }, "devDependencies": { "@types/node": "^22.0.0", "rimraf": "^5.0.0", "tsup": "^8.5.1", "tsx": "^4.21.0", "typescript": "^5.7.0",
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 87% confidence
- Finding
The unpinned tsup devDependency increases supply-chain risk because future installs may resolve to different releases, and this package family has at least one known advisory in some versions. While tsup is a build-time tool rather than a runtime dependency, compromised or vulnerable build tooling can still affect produced artifacts or developer environments.
- Content
json "devDependencies": { "@types/node": "^22.0.0", "rimraf": "^5.0.0", "tsup": "^8.5.1", "tsx": "^4.21.0", "typescript": "^5.7.0", "vitest": "^3.0.0"
Unverifiable Dependency: tsup has 1 known advisory(ies) (CVE-2024-53384 (tsup DOM Clobbering vulnerability)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
This is a true supply-chain vulnerability risk because the manifest does not pin tsup, so installs may resolve to a version affected by a known advisory without the repository clearly documenting which version is actually used. Since tsup is build tooling, the primary exposure is to developers/CI and potentially to integrity of generated artifacts, not directly to end users at runtime.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
- Content
json "@types/node": "^22.0.0", "rimraf": "^5.0.0", "tsup": "^8.5.1", "tsx": "^4.21.0", "typescript": "^5.7.0", "vitest": "^3.0.0" },
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 40% confidence
- Finding
Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.
- Content
json "rimraf": "^5.0.0", "tsup": "^8.5.1", "tsx": "^4.21.0", "typescript": "^5.7.0", "vitest": "^3.0.0" }, "engines": {
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 89% confidence
- Finding
The unpinned vitest devDependency introduces supply-chain uncertainty, and the package has multiple advisories affecting some versions. Even though vitest is used in testing rather than production runtime, vulnerable test tooling can expose developer or CI environments, especially if UI/server features or mock-related functionality are used.
- Content
json "tsup": "^8.5.1", "tsx": "^4.21.0", "typescript": "^5.7.0", "vitest": "^3.0.0" }, "engines": { "node": ">=20.0.0"
Unverifiable Dependency: vitest has 3 known advisory(ies) (CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed); CVE-2026-84373 (Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock); CVE-2025-24964 (Vitest allows Remote Code Execution when accessing a malicious website while Vit)), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 92% confidence
- Finding
This is a true vulnerability risk because vitest is not pinned and has multiple known advisories in some releases, including arbitrary file read and potential code execution scenarios in certain modes. Although vitest is a dev/test dependency, those impacts can materially affect developer workstations or CI runners if vulnerable features are enabled or malicious test content is encountered.
- Content