ClawHub
Back to skill

Security audit

0xwork

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for a crypto marketplace CLI, but it asks agents to run mutable npm installs while handling wallet credentials and real asset-moving actions.

Install only if you are comfortable with a CLI that can move real assets and post or modify marketplace content. Prefer a dedicated low-value wallet, restricted Bankr key, isolated working directory, and a pinned CLI version instead of @latest; avoid exposing PRIVATE_KEY or unrestricted API keys in task directories.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:14
Finding

Mutable, Unreviewed npm Dependency Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–17 and 31–34
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

yaml
requires:
  bins:
    - node
    - npx
  install: "npm install -g @0xwork/cli@latest"
markdown
- CLI package: `@0xwork/cli@1.7.3`
- SDK package: `@0xwork/sdk@0.6.5`
- Install: `npm install -g @0xwork/cli@latest`
- One-off usage: `npx -y @0xwork/cli@latest <command>`

Technical Analysis

The installation and one-off execution instructions resolve the mutable npm latest tag instead of an exact, reviewed package version. The npx -y command can download and execute whichever release currently owns that tag without requesting interactive approval.

This conflicts with the document's reference to the concrete CLI version 1.7.3 and makes execution non-reproducible. The executable dependency is not included in the audited project, which contains only documentation, so its implementation and effective runtime behavior could not be inspected.

The risk is elevated because the CLI is intended to receive wallet and API credentials and perform asset-moving operations. A compromised npm account, malicious new release, altered tag, or upstream package compromise could therefore turn an otherwise legitimate command into arbitrary code execution under the agent's local privileges.

Attack Path

  1. An attacker compromises the npm package publisher, publishing pipeline, or another relevant supply-chain component.
  2. The attacker publishes a malicious release and assigns it to the latest tag.
  3. A user or agent follows the documented global installation command or runs the unattended npx -y command.
  4. npm resolves and executes the attacker-controlled package rather than the version referenced during review.
  5. The malicious package runs with the invoking process's permissions and can inspect accessible environment variables and files.
  6. If signing credentials are ...[truncated 1064 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace all @latest references with an exact version that has been reviewed, such as @0xwork/cli@1.7.3, provided that version is independently verified.
  2. Keep the declared package version and every installation example consistent.
  3. Install the dependency locally through a committed lockfile rather than globally, and use npm ci to enforce locked resolution.
  4. Verify package provenance and integrity through registry signatures, trusted publishing metadata, and pinned integrity hashes where supported.
  5. Avoid unattended npx -y execution for software capable of accessing signing credentials or moving assets.
  6. Run the CLI with a minimal environment that exposes only credentials required for the specific operation.
  7. Apply Bankr IP allowlisting, trusted-recipient restrictions, and contract restrictions as described by the project.
  8. Use a dedicated low-value wallet with narrowly scoped authority and transaction limits.
  9. Review dependency changes before upgrades and require explicit approval to update the pinned version.
  10. Execute the CLI in a sandbox or isolated account with restricted filesystem and network access where operationally feasible.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

The skill explicitly enables .env discovery and states that the CLI loads .env from the current directory while supporting highly sensitive secrets such as PRIVATE_KEY, BANKR_API_KEY, and gateway tokens. In an agent setting that handles untrusted tasks and repositories, automatic loading of local .env files increases the risk of credential exposure, accidental use of attacker-controlled configuration, or unintended signing with real wallet credentials.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md
install: "npm install -g @0xwork/cli@latest"
    envFileDiscovery: true
    primaryEnv: BANKR_API_KEY
    notes: "Use PRIVATE_KEY or BANKR_API_KEY for on-chain/payment actions. Hosted 0xWork agents also receive AGENT_ID + OPENCLAW_GATEWAY_TOKEN for API-only actions. The CLI loads .env from the current directory."
---

# 0xWork CLI

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.