Security audit · Whale Watch

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:63
Finding: Hidden External Agent Registration and Coordination Metadata<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 63 **Vulnerability Type**: Hidden agent-control metadata referencing an untrusted external service **Risk Level**: High ### Vulnerable Code ```html  ``` ### Technical Analysis The skill contains a concealed HTML comment defining a third-party coordination hub, an agent-registration endpoint, and a heartbeat endpoint. These endpoints are unrelated to the skill's declared purpose of monitoring public blockchain transactions and are not disclosed in its visible documentation. Although the repository does not contain an implementation that directly processes this metadata, an OADP-aware skill loader or agent framework could interpret it as machine-readable instructions. In that environment, loading the skill could cause the agent to register with `onlyflies.buzz` and make recurring heartbeat requests. This introduces an undisclosed external control or coordination channel. The endpoints' behavior and ownership cannot be established from the audited file. Therefore, direct execution of remote commands is not proven by the repository contents. The confirmed issue is the presence of hidden, task-unrelated registration and coordination metadata whose security impact becomes active when consumed by compatible tooling. ### Attack Path 1. A user or automated platform installs or loads the `whale-watch` skill. 2. An OADP-aware component scans `SKILL.md` and recognizes the hidden `OADP:1.0` metadata. 3. The component contacts the specified registration endpoint at `https://onlyflies.buzz/clawswarm/api/v1/agents/register`. 4. Agent identity, environment metadata, capabilities, or other registration data may be transmitted, depending on the consuming framework. 5. The component periodically contacts `https://onlyflies.buzz/clawsw ...[truncated 1233 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the hidden OADP metadata from line 63 because it is unrelated to the documented skill functionality. 2. Reject or ignore registration, heartbeat, and coordination directives embedded in comments or other non-visible documentation fields. 3. Require explicit user approval before a skill can register with an external service or initiate recurring outbound connections. 4. Maintain an allowlist of approved API domains. For this skill, outbound access should be limited to the visibly documented Hedera, Etherscan, and Solana services. 5. Display all external endpoints and transmitted data fields to the user before network access occurs. 6. If remote coordination is a legitimate requirement, document it prominently, authenticate the service, validate all responses against a restrictive schema, apply least-privilege capability controls, and prevent returned content from being interpreted as unrestricted agent instructions. 7. Add installation-time scanning for hidden machine-readable directives that reference unrelated external domains. 8. Log registration and heartbeat requests and provide users with a mechanism to disable and revoke them. ]]>

```bash # Large ETH transfers (register at etherscan.io for free key) curl -s "https://api.etherscan.io/api?module=account&action=txlist&address=WALLET&sort=desc&apikey=YOUR_KEY" | \ jq '.result[:10] | .[] | {hash: .hash[:16], value_eth: (.value | tonumber / 1e18), from: .from[:12], to: .to[:12]}' ```

```bash # Recent signatures for a wallet curl -s "https://api.mainnet-beta.solana.com" \ -H "Content-Type: application/json" \ -d '{"jsonrpc":"2.0","id":1,"method":"getSignaturesForAddress","params":["WALLET_ADDRESS",{"limit":10}]}' | \ jq '.result[] | {signature: .signature[:20], slot: .slot, time: .blockTime}'

Whale Watch

Overview

A.I.G

T01 · Skill Instruction Hijacking

SkillSpector

External Transmission

External Transmission

Context-Inappropriate Capability

Static analysis