T03 · Remote Payload Retrieval and Execution
Error
- Location
README.md:77- Finding
Unverified Remote Script Is Piped Directly into a Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
AegisClaw - 金甲龙虾
Security checks for vulnerabilities and agentic risk
Overview
This is a real Binance automation skill, but it asks for live trading credentials and can convert assets without a confirmation step while overstating safety.
Review carefully before installing. Use only a dedicated Binance sub-account with small balances, no withdrawal permission, IP allowlisting, and preferably testnet/read-only credentials first. Do not paste API secrets into chat or shell commands. Treat `/aegisclaw dust` as a real, immediate asset conversion, and avoid the README's remote `curl | sh` installer path unless independently verified.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (8)
T09 · Insecure Skill Coding Practices
Error
- Location
core/asset_scanner.py:127- Finding
Real Asset Conversion Executes Without Confirmation or Enforced Safety Controls
- Content
View full analysis
Dict: """执行零钱兑换""" if assets is None: scan = self.scan_idle_assets() assets = [a["asset"] for a in scan.get("dust_assets", [])] if not assets: return {"success": False, "message": "没有可兑换的零钱"} try: # 使用 dust_transfer 接口兑换为 BNB result = self.api_client.dust_transfer(assets) return { "success": True, "result": result, "message": f"已将 {', '.join(assets)} 兑换为 BNB" } except Exception as e: return { "success": False, "error": str(e), "message": f"兑换失败: {str(e)}" } ``` The plugin exposes the operation directly: ```python def cmd_dust_sweep(self, args: list) -> Dict: """零钱兑换命令""" check = self.check_initialized() if check: return check try: result = self.asset_scanner.execute_dust_sweep(args) if result["success"]: self.database.save_trade({ "type": "dust_sweep", "status": "completed", "quantity": 0, "details": {"assets": args} }) ``` ### Technical Analysis Invoking the `dust` command immediately submits a signed Binance conversion request. The operation lacks: - A preview and explicit second-step confirmation. - Caller identity or authorization checks. - A prerequisite for a successful security check. - Per-operation or daily value limits. - Asset allowlists or denylists. - Idempotency or replay protection. - Enforcement of the advertised trade-frequency and slippage settings. - Testnet-by-default behavior. When no assets are supplied, the cod ...[truncated 1161 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
openclaw_plugin/plugin.py:110- Finding
Binance API Secrets Are Requested Through Observable Chat and Command-Line Channels
- Content
View full analysis
Dict: """初始化命令""" if len(args) < 2: return { "success": False, "error": "用法: /aegisclaw init [testnet]" } api_key = args[0] api_secret = args[1] testnet = len(args) > 2 and args[2].lower() == "testnet" return self.initialize(api_key, api_secret, testnet) ``` The CLI also accepts the secret as an argument: ```python parser.add_argument("--key", help="Binance API Key") parser.add_argument("--secret", help="Binance API Secret") ``` The documented chat command is: ```text /aegisclaw init ``` ### Technical Analysis Chat commands can be retained in conversation history, agent traces, server logs, telemetry, moderation systems, backups, or plugin-routing infrastructure. Command-line arguments may appear in shell history, process listings, job-control metadata, crash diagnostics, and endpoint-monitoring products. The code stores the credentials in process-global configuration after receiving them. There is no protected secret-entry mechanism, redaction guarantee, or integration with an operating-system or platform secret store. ### Attack Path 1. A user follows the documented initialization command and includes the Binance secret in chat or in `--secret`. 2. The containing message or command is recorded by one or more infrastructure layers. 3. Another user, local process, administrator, log reader, compromised service, or telemetry consumer accesses the retained value. 4. The exposed key and secret are used to make signed Binance API requests. 5. The resulting access depends on the permissions assigned to the Binance key and may ...[truncated 430 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
core/security_checker.py:88- Finding
Security Fence Uses Unreliable Account and Permission Detection
- Content
View full analysis
str: """检测账户类型（主账户 vs 子账户）""" # 通过账户权限特征判断 permissions = account.get("permissions", []) if "SPOT" in permissions: # 如果余额较小，可能是子账户 total_stable = sum(b["total"] for b in balances if b["asset"] in ["USDT", "FDUSD"]) if total_stable < 1000: return "sub_account_recommended" elif total_stable > 10000: return "main_account_detected" return "sub_account" def _check_permissions(self, account: Dict) -> Dict: """检查 API 权限""" # 币安 API 不会直接返回权限信息 # 我们需要通过尝试调用受限接口来判断 permissions = ["SPOT"] # 假设有现货权限（否则无法获取账户信息） dangerous = [] # 检查是否有提现权限（通过接口尝试） # 注意：这里只是模拟检查，实际不应该调用提现接口 # 实际情况需要用户手动配置时说明 # 检查是否有合约权限 try: # 尝试获取合约账户信息 url = f"{self.api_client.base_url.replace('api', 'fapi')}/fapi/v2/account" response = self.api_client.session.get(url) if response.status_code == 200: permissions.append("FUTURES") except: pass # 标记危险权限 for forbidden in self.config.forbidden_permissions: dangerous.append(forbidden) return { "all_permissions": permissions, "dangerous": dangerous } ``` ### Technical Analysis Account type is inferred from stablecoin balance rather than verified through an authoritative Binance account or sub-account API. A low-balance main account can therefore be reported as a recommended sub-account. The permission check assumes spot permission, makes an unsigned futures-account request without a timeout, silently ignores all exceptions, and always adds every configured forbidden permission to the dangerous list regardless of actual key permissions. Consequently, both posit ...[truncated 1091 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
requirements.txt:4- Finding
Dependencies Are Installed from Mutable Unpinned Version Ranges
- Content
View full analysis
=2.31.0 # 环境变量 python-dotenv>=1.0.0 # 日期处理 python-dateutil>=2.8.2 # 数据可视化（可选，用于海报生成） matplotlib>=3.8.0 ``` The installer resolves these mutable ranges: ```python success = run_command( sys.executable + " -m pip install -r requirements.txt", "安装 Python 依赖" ) ``` ### Technical Analysis Lower-bound-only requirements permit installation of any later version and any transitive dependency selected by the package resolver. No lockfile, exact version pins, package hashes, or trusted index restrictions are supplied. The package names appear to be legitimate PyPI projects; no specific malicious dependency was identified. The risk arises because the reviewed source does not determine the code that will actually be installed in the future. ### Attack Path 1. A user runs `install.py` or manually installs `requirements.txt`. 2. `pip` resolves the latest versions satisfying each `>=` constraint. 3. A compromised upstream release, compromised maintainer account, package-index attack, or malicious transitive dependency is selected. 4. The dependency’s installation or imported runtime code executes in the user’s environment. 5. Because AegisClaw handles Binance credentials, a compromised dependency could access and exfiltrate them. ### Impact Assessment A compromised dependency executes with the privileges of the Python installation process and later with the privileges of the Skill. It can access environment variables, `.env` contents, financial data, network connectivity, and local files. System-wide installation or elevated pip execution would increase the impact. ]]>- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
install.py:11- Finding
Installer Uses Shell Parsing for a Command That Does Not Require It
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
db/database.py:13- Finding
Financial Records Are Stored in a Predictable Plaintext Database Without Explicit Access Restrictions
- Content
View full analysis
int: """保存余额快照""" with sqlite3.connect(self.db_path) as conn: cursor = conn.cursor() cursor.execute(""" INSERT INTO balance_snapshots (bnb_amount, usdt_amount, total_assets, timestamp) VALUES (?, ?, ?, ?) """, ( snapshot["bnb_amount"], snapshot["usdt_amount"], snapshot["total_assets"], snapshot["timestamp"] )) conn.commit() return cursor.lastrowid ``` Trade details are also stored in plaintext: ```python def save_trade(self, trade: Dict) -> int: """保存交易记录""" with sqlite3.connect(self.db_path) as conn: cursor = conn.cursor() cursor.execute(""" INSERT INTO trades (type, symbol, side, quantity, price, order_id, status, profit, details, timestamp) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?) """, ( trade["type"], trade.get("symbol"), trade.get("side"), trade["quantity"], trade.get("price"), trade.get("order_id"), trade["status"], trade.get("profit"), json.dumps(trade.get("details", {})), trade.get("timestamp", datetime.now()) )) ``` ### Technical Analysis The predictable default path `db/aegisclaw.db` is created using inher ...[truncated 1273 chars]- Remediation
View remediation
other
Note
- Location
core/report_generator.py:56- Finding
Generated Financial Report Presents a Fabricated Comparative User Ranking
- Content
View full analysis
int: """模拟用户排名（实际需要真实数据对比）""" # 简单模拟：收益率越高排名越好 if profit_pct < 0: return 90 + int(abs(profit_pct) * 10) elif profit_pct < 1: return 60 + int((1 - profit_pct) * 30) elif profit_pct < 3: return 30 + int((3 - profit_pct) * 15) elif profit_pct < 5: return 10 + int((5 - profit_pct) * 5) else: return max(1, 10 - int((profit_pct - 5) * 2)) ``` The simulated value is presented as an actual comparative result: ```python text += f" • 用户排名: 超越 {report['user_rank']}% 用户\n\n" ``` ### Technical Analysis The code acknowledges internally that the ranking is simulated and lacks real comparison data, but the generated user-facing report presents it as though it were an observed percentile. This is an integrity issue in a financial reporting feature. The same project also markets funding arbitrage as “risk-free,” while the calculation does not account for transaction fees, slippage, execution timing, or basis risk. No hidden trade execution was identified in the arbitrage scanner itself. ### Attack Path 1. A user requests a weekly report. 2. The application calculates a percentile solely from the user’s local BNB percentage change. 3. No population data or external comparison dataset is queried. 4. The report states that the user outperformed a percentage of users. 5. The user may share or rely on the fabricated metric as if it were factual. ### Impact Assessment The issue can mislead users about investment performance and the standing of the strategy. It does not directly grant system privileges or execut ...[truncated 108 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (66)
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The README simultaneously tells users to disable futures permissions and advertises funding-rate arbitrage that inherently depends on futures/contracts access. This contradiction can confuse operators about the necessary privileges and safety model, leading them to enable risky derivatives permissions under the false impression the tool remains 'defensive' or low-risk.
- Content
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Describing a financial trading capability as 'risk-free' is an unsafe and misleading claim. Users may rely on that language to justify enabling trading permissions or deploying automation without appropriate controls, exposing them to market, execution, liquidation, and operational risk.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md # 3. 配置环境变量 # Windows: 复制 .env.example 为 .env 并编辑 # Linux/Mac: cp .env.example .env # 编辑 .env 填入你的币安 API Key # 4. 运行
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 97% confidence
- Finding
The README instructs users to install software via a remote script piped directly into a shell. This bypasses normal inspection and integrity verification, creating a supply-chain execution risk where a compromised CDN, MITM, or malicious installer could run arbitrary commands on the host.
- Content
安装 Claude Code
bash # macOS/Linux curl -fsSL https://cdn.anthropic.com/install.sh | sh # Windows (使用 scoop) scoop install claude-code
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
Using 'curl ... | sh' is a classic command-chaining pattern that turns fetched network content directly into code execution. In the context of a financial automation skill where users may run setup commands on machines holding API credentials, the host compromise risk is especially serious.
- Content
安装 Claude Code
bash # macOS/Linux curl -fsSL https://cdn.anthropic.com/install.sh | sh # Windows (使用 scoop) scoop install claude-code
Natural-Language Policy Violations
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The closing tagline repeats the unsupported 'risk-free earning' promise, reinforcing a misleading safety narrative around a live-account financial tool. Repetition of this claim increases the likelihood that users underestimate the hazards of autonomous conversion, arbitrage, or derivatives-related workflows.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
There is a clear description-to-code mismatch. The declared purpose promises substantial Binance-related capabilities and specific commands, but the provided code chunk is effectively empty and does not implement any of them. This is a materially different actual behavior because there is no functional behavior present at all.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The code only partially aligns with the description. It does support Binance asset access and dust sweep operations, which fit the declared purpose. However, it is not narrowly implementing account security checks, arbitrage scanning, or command handlers; instead it exposes a broad Binance trading client. Most notably, it includes undeclared trading capabilities such as placing and canceling spot orders and retrieving open orders and personal trade history. It also accesses futures market data endpoints, which are not mentioned in the description. While some market data methods could support arbitrage scanning, the implemented behavior is materially broader than the declared purpose, so this should be flagged as a mismatch.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The code is focused narrowly on scanning balances for idle stablecoins, detecting dust assets, suggesting Launchpool participation, converting dust to BNB, and generating a report. This only partially matches the declared description. The declaration prominently includes account security checks and arbitrage scanning, but neither capability appears in this code. It also suggests broader Binance asset management and command handling (init, check, arbitrage, status), which are not implemented in the supplied chunk. Additionally, the code includes Launchpool opportunity retrieval and recommendations, which is a material capability not mentioned in the declared purpose. Therefore the description does not accurately represent this code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 90% confidence
- Finding
The supplied code is consistent with part of the description: it does scan for arbitrage opportunities and produce a report, specifically for funding-rate arbitrage. However, the declared purpose describes a much broader skill covering Binance asset management, account security checks, automated dust sweeps, and multiple commands. None of those additional capabilities appear in this code chunk. This is a material description-to-behavior mismatch because the actual code’s primary behavior is much narrower and specialized than the declared skill. There is no evidence here of undeclared harmful behavior or inconsistent resource access; the mismatch is primarily overbroad description versus limited implementation.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
There is a meaningful description-behavior mismatch. While the declared description includes account security checking, it presents the skill broadly as a Binance asset-management and trading-assistance tool with capabilities like arbitrage scanning and dust sweeps. The provided code chunk only supports the security-check portion: API connectivity testing, account/balance retrieval, heuristic account classification, permission probing, scoring, recommendations, and report formatting. The primary implemented purpose in this chunk is security auditing, not managing assets or executing/scanning trading operations. This is materially narrower and different from the declared multi-function purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description describes a feature-rich Binance automation and analysis skill, but the provided code chunk does not implement any of those capabilities. It is only a stub file for a database module with no functional logic. This is a material mismatch in primary purpose and actual behavior.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
The declared description presents a functional Binance operations skill that can manage assets, check security, scan arbitrage, and perform dust sweeps. However, the supplied code chunk does not implement any of those behaviors. It only performs local installation and environment setup tasks: dependency installation, .env template creation, and user guidance. While this setup script references Binance API keys and mentions later running checks via main.py, that is not the same as actually implementing the declared commands or capabilities in this code chunk. Therefore, the code's actual behavior materially differs from the declared purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The declared description promises a specific Binance-focused skill with multiple operational commands and reliance on Binance API credentials. The actual code chunk contains only a placeholder module file with a comment and no executable behavior matching any of those claims. This is a material mismatch in primary purpose and implemented capabilities. The module name/comment also suggests an unrelated OpenClaw plugin rather than a Binance management tool.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The manifest instructs users to initialize the plugin with an API key and API secret but provides no warning against exposing secrets in chat, logs, command history, or stored configuration. In a crypto-trading context, mishandled Binance credentials can enable unauthorized account access or trading activity, making the omission materially risky.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md from dataclasses import dataclass, field from typing import List # 加载 .env 文件 env_path = Path(__file__).parent / ".env" if env_path.exists(): from dotenv import load_dotenv
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md from dataclasses import dataclass, field from typing import List # 加载 .env 文件 env_path = Path(__file__).parent / ".env" if env_path.exists(): from dotenv import load_dotenv
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md from dataclasses import dataclass, field from typing import List # 加载 .env 文件 env_path = Path(__file__).parent / ".env" if env_path.exists(): from dotenv import load_dotenv
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python from dataclasses import dataclass, field from typing import List # 加载 .env 文件 env_path = Path(__file__).parent / ".env" if env_path.exists(): from dotenv import load_dotenv
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python from dataclasses import dataclass, field from typing import List # 加载 .env 文件 env_path = Path(__file__).parent / ".env" if env_path.exists(): from dotenv import load_dotenv
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python from dataclasses import dataclass, field from typing import List # 加载 .env 文件 env_path = Path(__file__).parent / ".env" if env_path.exists(): from dotenv import load_dotenv
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python from typing import List # 加载 .env 文件 env_path = Path(__file__).parent / ".env" if env_path.exists(): from dotenv import load_dotenv load_dotenv(env_path)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python from typing import List # 加载 .env 文件 env_path = Path(__file__).parent / ".env" if env_path.exists(): from dotenv import load_dotenv load_dotenv(env_path)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
- Content
python """运行命令""" print(f"📦 {description}...") try: result = subprocess.run(cmd, shell=True, check=True, capture_output=True, text=True) print(f"✅ {description} 完成") return True except subprocess.CalledProcessError as e:
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The dust sweep command triggers a real asset-conversion operation immediately via execute_dust_sweep(args) and records the trade afterward, but there is no confirmation step, dry-run preview, or explicit risk acknowledgment. Because dust conversion is an irreversible financial action, accidental invocation, prompt injection, or user misunderstanding could cause unwanted trades on a live Binance account.
- Content
Static analysis
No suspicious patterns detected.