ClawHub
Back to skill

Security audit

Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is not deceptive, but it gives an autonomous agent broad live-wallet, trading, and blockchain administration powers that can move funds and persist keys without enough upfront guardrails.

Install only if you intend to give an agent live wallet authority. Use a fresh low-balance wallet, testnets or small limits first, isolate the runtime, protect or avoid persistent keystores where possible, pin external CLI paths, and require manual approval for transfers, swaps, bridge/composer actions, prediction-market orders, leveraged trades, proxy upgrades, and validator or subnet administration.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill prominently advertises autonomous key generation and transaction-capable wallet operations across many chains, but does not place a clear, upfront warning that actions can move real funds, incur gas costs, and cause irreversible on-chain state changes. In an agent context, this increases the chance that a model or operator invokes high-risk tools without adequately understanding custody and financial consequences.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
75% confidence
Finding

The skill persists wallet secrets in a local encrypted keystore under a predictable path, enabling session continuity and autonomous reuse of signing authority. Even though the keystore is encrypted and file permissions are restrictive, persistence of hot-wallet credentials increases exposure if the host, entropy file, or local account is compromised.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

md
1. **First run:** Generates a BIP-39 mnemonic via `ethers.HDNodeWallet.createRandom()`
2. **Encryption:** AES-128-CTR + scrypt KDF (geth-compatible keystore format)
3. **Password derivation:** 32-byte random entropy file via `crypto.randomBytes(32)`
4. **File permissions:** chmod 0o600 (owner read/write only)
5. **Storage location:** `~/.evalanche/keys/` by default

### MCP Server Access Controls

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trading and prediction-market tools execute live financial orders and position management, but the documentation lacks an explicit warning about real-money exposure, slippage, liquidation risk, and irreversible order execution. In an agent-driven environment, omission of this warning materially raises the risk of accidental losses or unauthorized speculative behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documented admin operations such as subnet creation, validator management, ownership transfer, and disabling validators are high-impact infrastructure actions, yet they are listed like ordinary tools without conspicuous warnings about operational, financial, and network-availability consequences. An autonomous agent could misuse them and cause outages, governance loss, or staking/validator disruption.

Content

No source excerpt is available for this finding.

Excessive Permissions

Low
Category
Privilege Escalation
Confidence
80% confidence
Finding

Skill requests more permissions than appear necessary for its stated functionality. Review if elevated access is justified.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

md
1. **First run:** Generates a BIP-39 mnemonic via `ethers.HDNodeWallet.createRandom()`
2. **Encryption:** AES-128-CTR + scrypt KDF (geth-compatible keystore format)
3. **Password derivation:** 32-byte random entropy file via `crypto.randomBytes(32)`
4. **File permissions:** chmod 0o600 (owner read/write only)
5. **Storage location:** `~/.evalanche/keys/` by default

### MCP Server Access Controls

Static analysis

No suspicious patterns detected.