ClawHub
Back to skill

Security audit

tytyt

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent SDK documentation, but it normalizes raw wallet private-key use and paid agent calls without enough safeguards for irreversible financial risk.

Review before installing. Use a dedicated low-value wallet, keep only minimal USDC for testing, avoid broad token allowances, store the private key only in a secrets manager or tightly controlled environment variable, pin and review the SDK version, and treat every paid agent call as capable of spending funds.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:16
Finding

Unpinned Third-Party SDK Is Given Raw Wallet-Signing Authority

Content
View full analysis
Remediation
View remediation
``` 2. Commit and enforce a package-manager lockfile with integrity metadata. Use deterministic installation in automation, such as `npm ci` or the equivalent frozen-lockfile mode. 3. Verify package provenance, publisher identity, signatures or attestations, and registry origin before installation. Configure the package manager to use only the intended trusted registry. 4. Perform dependency review and vulnerability scanning whenever the pinned SDK version or lockfile changes. Treat updates as security-sensitive because the dependency handles signing authority. 5. Do not expose a high-value wallet's raw private key to application dependencies. Prefer an external signer, hardware wallet, isolated signing service, or narrowly scoped wallet interface that keeps private-key material outside the SDK process. 6. Use a dedicated low-value wallet for agent payments. Maintain only the minimum required balance and avoid unrelated assets or broad token allowances. 7. Add transaction value limits, destination and chain allowlists, spending quotas, and explicit approval for payments above a minimal threshold. 8. Run the integration in a restricted environment with minimal filesystem permissions, filtered outbound network access, and no unrelated secrets in its environment. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documentation instructs users to supply an Ethereum private key directly in configuration without an explicit warning that this credential grants full control of the wallet. In security-sensitive agent tooling, normalizing direct private key handling without safety guidance can lead to credential exposure, wallet compromise, and irreversible loss of funds.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The example workflow actively connects a wallet, invites an agent, and sends a request to an agent that may use x402 micropayments, but it does not present a prominent warning that running the example can automatically spend USDC. In a skill context, users may copy-paste the sample code directly, so the omission materially increases the risk of unintended financial loss.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 534)May include surrounding context.

Network-specific RPC URLs (for balance checks)

BASE_RPC_URL=https://mainnet.base.org PEAQ_RPC_URL=https://peaq.api.onfinality.io/public AVAX_RPC_URL=https://api.avax.network/ext/bc/C/rpc

text

## TypeScript Types

Static analysis

No suspicious patterns detected.