ClawHub
Back to skill

Security audit

ClawPay Escrow

Security checks for vulnerabilities and agentic risk

Overview

This payment skill is coherent, but it asks agents to handle real Solana funds and private keys with overly broad key discovery and an unpinned SDK install.

Review before installing. Use only a dedicated low-balance wallet, set SOLANA_KEYPAIR_PATH to the exact key you intend to use, avoid program or deployment keys, verify the package source/version before installation, and require a clear confirmation of recipient, amount, network, timing windows, and fees before any transaction is signed.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:27
Finding

Unpinned Third-Party Package Installation in a Wallet-Signing Workflow

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27-31
Vulnerability Type: Supply-chain exposure through an unpinned dependency
Risk Level: Medium

Vulnerable Code Snippet:

bash
First, check if clawpay is installed:

pip3 show clawpay

If not installed:

pip3 install clawpay

Technical Analysis

The Skill instructs the agent to install clawpay directly from the default Python package index without specifying an exact version or validating an integrity hash. Consequently, the package installed during execution may differ from the package that existed when the Skill was reviewed.

This is especially sensitive because the installed SDK is subsequently imported into a process that reads a Solana private keypair and performs signed financial transactions. Python package initialization and imported modules can execute arbitrary code with the privileges of the agent process. The repository does not bundle or lock the dependency's source, so the effective SDK implementation cannot be audited from this artifact.

This finding does not establish that the current clawpay package is malicious. The vulnerability is the absence of version and integrity controls around a security-sensitive dependency.

Attack Path

  1. An attacker compromises the package publisher account, the package registry, or an upstream release process.
  2. The attacker publishes a modified clawpay release under the expected package name.
  3. The agent runs pip3 install clawpay, which resolves and installs the modified release without a version or hash check.
  4. The workflow imports Client from the installed package while operating in a wallet-signing context.
  5. Malicious package code executes with the privileges of the agent process.
  6. The code may read accessible files or environment variables, interfere with transaction construction, substitute recipient addresses, or capture wallet key material when it is pass ...[truncated 602 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to an exact, reviewed version, for example clawpay==X.Y.Z.
  2. Install from a lock file with cryptographic hashes, using a command such as pip install --require-hashes -r requirements.txt.
  3. Verify the package publisher, source repository, release provenance, and package contents before approval.
  4. Use an isolated virtual environment rather than installing into a shared Python environment.
  5. Prevent automatic dependency upgrades in production wallet-signing environments.
  6. Review the complete transitive dependency tree and pin those packages as well.
  7. Run the SDK in a restricted process with minimal filesystem and network permissions.
  8. Prefer an external or hardware-backed signer so dependency code never receives raw private-key material.

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:34
Finding

Overbroad Discovery and Direct Loading of Solana Private Keys

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 34-39 and 64-65; the same direct key loading is repeated at lines 93-94
Vulnerability Type: Excessive access to sensitive signing credentials
Risk Level: High

Vulnerable Code Snippet:

text
The user's Solana wallet keypair is required. Check for it at the path in the `SOLANA_KEYPAIR_PATH` environment variable, or look for common locations:
- `~/wallet.json`
- `~/.config/solana/id.json`
- `~/projects/clawpay/program-keypair.json`

If no keypair is found, ask the user to provide one or generate one with `solana-keygen new --outfile ~/wallet.json`.
python
keypair = Keypair.from_json(open("KEYPAIR_PATH").read())
client = Client(keypair)

The direct key loading pattern is repeated in the delivery-confirmation example:

python
keypair = Keypair.from_json(open("KEYPAIR_PATH").read())
client = Client(keypair)

Technical Analysis

The Skill directs the agent to search several conventional filesystem locations for private Solana keypairs instead of requiring the user to approve one exact credential path. This broadens the Skill's access beyond the minimum credential explicitly configured for the task.

The inclusion of ~/projects/clawpay/program-keypair.json is particularly concerning because a program deployment key may have authority unrelated to ordinary escrow payments. Using such a key could expose higher-value deployment or administrative privileges.

After discovery, the complete plaintext keypair is read into process memory and supplied to the third-party SDK. Any code executing in that process—including imported package code—can potentially access the key material. Filesystem searches and raw key loading therefore increase both the likelihood and potential impact of credential compromise.

This finding does not show explicit exfiltration in SKILL.md; it concerns violation of least privilege and unnecessary expo ...[truncated 1538 chars]

Remediation
View remediation

Remediation Suggestions

  1. Require the user to approve one exact key or signer before any transaction-related operation.
  2. Use only the path explicitly supplied through SOLANA_KEYPAIR_PATH; do not probe fallback locations.
  3. Remove ~/projects/clawpay/program-keypair.json and all other program, deployment, or administrative keys from the workflow.
  4. Validate file ownership and restrictive permissions before use, and reject files writable by unauthorized users.
  5. Use a dedicated, low-balance wallet whose authority is limited to the intended escrow activity.
  6. Prefer a hardware wallet, operating-system key store, remote signer, or transaction-signing service that does not expose raw private-key bytes to the SDK.
  7. Present the selected public key, destination, amount, network, fees, and transaction intent to the user for confirmation before signing.
  8. Isolate transaction construction from signing and validate the fully constructed transaction independently before authorization.
  9. Avoid logging key contents, signer objects, environment variables, or wallet file paths.
  10. If a potentially sensitive program key has already been loaded into an untrusted process, rotate the associated authority and transfer assets to a newly generated key.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Session Persistence

Medium
Category
Rogue Agent
Confidence
78% confidence
Finding

The skill advertises capabilities to check payment status, view transaction history, and verify agent reputation, which implies accessing persistent financial records across sessions or identities. In a payments context, that increases privacy and data-exposure risk, especially if the agent retrieves or correlates historical wallet activity without explicit user scoping.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: clawpay
description: Send and receive escrow payments on Solana using ClawPay. Pay other AI agents, lock funds in escrow, confirm delivery, release payments, check receipts, and verify agent reputation. Use when asked to pay an agent, create an escrow, buy a service from another agent, sell a service, check payment status, or view transaction history.
version: 1.0.0
author: clawpay
metadata:

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The description uses broad activation phrases such as paying agents, buying services, selling services, and viewing transaction history without tight scope boundaries or explicit consent checkpoints. In an agent environment, this can cause the skill to activate on loosely related financial conversations and increase the risk of unintended payment-related actions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill instructs the agent to search for wallet keypairs in multiple filesystem locations and, if none are found, to generate a new Solana wallet with solana-keygen new. This expands the skill from payment operations into credential discovery and wallet provisioning, which can lead to unauthorized use of sensitive keys or creation of financial accounts without explicit, informed user consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The instruction 'When asked to pay an agent or buy a service' is ambiguous and tied directly to code that creates an escrow, a state-changing financial action. Without stronger gating, the skill may interpret conversational requests too broadly and initiate fund-locking workflows before verifying user intent, amount, counterparty, and authorization context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.