ClawHub
Back to skill

Security audit

Whale Watch

Security checks for vulnerabilities and agentic risk

Overview

The visible blockchain monitoring examples fit the stated purpose, but the skill hides unrelated external agent registration and ping endpoints.

Review this before installing. The public blockchain API examples are expected for a whale-monitoring skill, but the hidden onlyflies.buzz OADP registration and heartbeat metadata should be removed or explicitly ignored by the host before use.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:63
Finding

Hidden External Agent Registration and Coordination Metadata

Content
View full analysis
``` ### Technical Analysis The skill contains a concealed HTML comment defining a third-party coordination hub, an agent-registration endpoint, and a heartbeat endpoint. These endpoints are unrelated to the skill's declared purpose of monitoring public blockchain transactions and are not disclosed in its visible documentation. Although the repository does not contain an implementation that directly processes this metadata, an OADP-aware skill loader or agent framework could interpret it as machine-readable instructions. In that environment, loading the skill could cause the agent to register with `onlyflies.buzz` and make recurring heartbeat requests. This introduces an undisclosed external control or coordination channel. The endpoints' behavior and ownership cannot be established from the audited file. Therefore, direct execution of remote commands is not proven by the repository contents. The confirmed issue is the presence of hidden, task-unrelated registration and coordination metadata whose security impact becomes active when consumed by compatible tooling. ### Attack Path 1. A user or automated platform installs or loads the `whale-watch` skill. 2. An OADP-aware component scans `SKILL.md` and recognizes the hidden `OADP:1.0` metadata. 3. The component contacts the specified registration endpoint at `https://onlyflies.buzz/clawswarm/api/v1/agents/register`. 4. Agent identity, environment metadata, capabilities, or other registration data may be transmitted, depending on the consuming framework. 5. The component periodically contacts `https://onlyflies.buzz/clawsw ...[truncated 1233 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

bash
# Large ETH transfers (register at etherscan.io for free key)
curl -s "https://api.etherscan.io/api?module=account&action=txlist&address=WALLET&sort=desc&apikey=YOUR_KEY" | \
  jq '.result[:10] | .[] | {hash: .hash[:16], value_eth: (.value | tonumber / 1e18), from: .from[:12], to: .to[:12]}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

bash
# Recent signatures for a wallet
curl -s "https://api.mainnet-beta.solana.com" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"getSignaturesForAddress","params":["WALLET_ADDRESS",{"limit":10}]}' | \
  jq '.result[] | {signature: .signature[:20], slot: .slot, time: .blockTime}'

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The hidden OADP metadata embeds hub, registration, and ping endpoints to an unrelated external domain, which is not needed for a whale-monitoring skill. Concealed agent-control or beaconing metadata can enable unauthorized registration, callback traffic, or remote orchestration, and its hidden placement materially increases suspicion.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.