ClawHub
Back to skill

Security audit

Agent Cashflow

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent revenue-reporting helper, but it needs review because it misstates wallet privacy, suggests sending financial reports to Telegram and memory, and encourages reputation manipulation.

Review before installing or copying the examples. Use ETH tracking only if you are comfortable sending the wallet address to public RPC providers, avoid the Telegram/memory cron prompt unless you want those reports stored and forwarded, and do not follow the multiple-account starring advice.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (2)

other

Warning
Location
SKILL.md:96
Finding

Ethereum Wallet Address Transmitted to Third-Party RPC Providers Despite Contrary Privacy Claim

Content
View full analysis
float: payload = {"jsonrpc":"2.0","method":"eth_getBalance", "params":[address,"latest"],"id":1} for url in ["https://eth.llamarpc.com", "https://rpc.ankr.com/eth"]: try: r = requests.post(url, json=payload, timeout=8) ``` The documented privacy claim states: ```text - Does not store or transmit your wallet address to any third party ``` ### Technical Analysis The `get_eth_balance` function inserts the user's Ethereum wallet address into a JSON-RPC request and sends it to `eth.llamarpc.com` or `rpc.ankr.com`. Both endpoints are externally operated third-party services. This behavior directly contradicts the documented claim that the skill does not transmit the wallet address to third parties. Although an Ethereum address is public on-chain, associating it with request metadata such as an IP address, request timing, user agent, or service account can reveal additional information about its owner. The fallback logic may expose the same address to more than one provider if the first provider fails. The documentation does not disclose these recipients, explain their data-handling policies, or request informed consent. ### Attack Path 1. A user configures their Ethereum wallet address for optional balance tracking. 2. The user or a scheduled agent executes the supplied report code. 3. `get_eth_balance` places the address in an `eth_getBalance` JSON-RPC request. 4. The request is sent to `https://eth.llamarpc.com`. 5. If that request fails or does not produce a usable result, the address may also be sent to `https://rpc.ankr.com/eth`. 6. The RPC provider can log the wallet address together with network and timing metadata. 7. The provider, a compromised provider, or a party with ...[truncated 587 chars]
Remediation
View remediation

other

Warning
Location
SKILL.md:149
Finding

Scheduled Reports Disclose and Persist Financial Data Through Telegram and Agent Memory

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The documentation states that the skill does not transmit the wallet address to any third party, but the provided code sends the wallet address to public Ethereum RPC endpoints to query balance. This is a security-relevant misrepresentation because users may disclose financial identifiers under false privacy assumptions, enabling unintended third-party exposure and trust erosion.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill explicitly encourages users to star their own skills from multiple accounts to boost visibility, which is coordinated manipulation of platform reputation signals. This can facilitate fraud, undermine marketplace integrity, and expose users to account enforcement or broader trust and abuse issues.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The code transmits the user's wallet address to external Ethereum RPC providers when requesting a balance. While this is functionally necessary for remote balance lookups, it still exposes a financial identifier to third parties and becomes more concerning because the skill later claims no such transmission occurs.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

md
"params":[address,"latest"],"id":1}
    for url in ["https://eth.llamarpc.com", "https://rpc.ankr.com/eth"]:
        try:
            r = requests.post(url, json=payload, timeout=8)
            result = r.json().get("result")
            if result:
                return int(result, 16) / 1e18

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 126)May include surrounding context.

md
def get_eth_price() -> float:
    try:
        r = requests.get(
            "https://api.coingecko.com/api/v3/simple/price?ids=ethereum&vs_currencies=usd",
            timeout=8
        )
        return r.json()["ethereum"]["usd"]

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The scheduled example instructs the system to send results to Telegram and memory without clearly warning that portfolio metrics and potentially wallet-related data may be transmitted to external services or persisted. In an automation context, silent forwarding increases the chance of oversharing operational or financial information beyond the user's intended audience.

Content

No source excerpt is available for this finding.