ClawHub
Back to skill

Security audit

Coinbase OpenAPI Skill

Security checks for vulnerabilities and agentic risk

Overview

This Coinbase trading skill is coherent, but it enables live financial order actions with weak confirmation guidance and a mutable remote schema source.

Review this carefully before installing. Prefer read-only Coinbase API credentials for discovery, avoid trading-enabled keys unless you intend to place live orders, require your agent to show exact order or cancellation parameters before every write, and use a pinned or bundled schema rather than the mutable remote main-branch URL.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
references/usage-patterns.md:3
Finding

Runtime CLI Generation Trusts a Mutable Remote OpenAPI Schema

Content
View full analysis
Remediation
View remediation
/skills/coinbase-openapi-skill/references/coinbase-advanced-trade.openapi.json ``` 3. Publish the expected SHA-256 digest and verify the downloaded file before passing it to UXC. 4. Make schema verification fail closed. Do not continue if the digest, signature, host, or expected API paths differ. 5. Extend `scripts/validate.sh` to verify that the documented schema reference is immutable and matches the bundled schema. 6. Review and approve schema updates through the same security process used for executable skill changes. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
references/usage-patterns.md:66
Finding

Live Financial Operations Do Not Require an Explicit Confirmation Gate

Content
View full analysis
",""]}' ``` ``` `SKILL.md` describes these operations as high-risk writes, but the workflow does not require explicit user confirmation immediately before execution. ### Technical Analysis The skill exposes order creation and batch cancellation against the live Coinbase Advanced Trade API. It correctly labels these operations as high risk, but that warning is advisory rather than an enforceable workflow requirement. There is no documented requirement to: - Obtain explicit user approval immediately before submission. - Present the final product, side, size, price, and maximum transaction value. - Confirm every order identifier before cancellation. - Reject incomplete or ambiguous trading instructions. - Re-fetch current market or account state before execution. - Use a dry-run, preview, or separate approval stage. - Distinguish educational examples from commands that place real orders. The supplied example contains concrete values and is explicitly described as creating a live limit order. An autonomous agent could therefore execute a financially consequential operation after interpreting ambiguous, stale, or attacker-influenced context without a final human authorization boundary. ### Attack Path 1. The skill is loaded with a Coin ...[truncated 1564 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The schema exposes authenticated order-creation and order-cancellation endpoints for a financial trading API without any embedded safety semantics such as confirmation requirements, scope separation, or usage constraints. In an agent-skill context, this increases the risk of unintended or over-broad execution of destructive financial actions if the surrounding agent invokes operations directly from the manifest.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The file includes concrete examples for placing live orders and cancelling orders against the production Coinbase API without an adjacent warning that these actions are real, financially consequential, and may be irreversible once submitted or filled. In a trading skill, operational examples are expected, but presenting write operations as copy-paste snippets increases the risk of accidental execution by users who are testing the integration.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md
rg -q 'jwt_bearer_v1' "${SKILL_FILE}" "${USAGE_FILE}" || fail 'missing jwt_bearer_v1 signer guidance'
rg -q 'COINBASE_KEY_ID' "${SKILL_FILE}" "${USAGE_FILE}" || fail 'missing key id guidance'
rg -q 'COINBASE_PRIVATE_KEY' "${SKILL_FILE}" "${USAGE_FILE}" || fail 'missing private key guidance'
rg -q 'uxc auth binding match https://api.coinbase.com/api/v3/brokerage/accounts' "${SKILL_FILE}" || fail 'missing binding match check'
rg -q 'high-risk writes' "${SKILL_FILE}" || fail 'missing high-risk write guidance'

if rg -q -- "--args\\s+'\\{" "${SKILL_FILE}" "${USAGE_FILE}"; then

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/usage-patterns.md (reported line 37)May include surrounding context.

md
rg -q 'jwt_bearer_v1' "${SKILL_FILE}" "${USAGE_FILE}" || fail 'missing jwt_bearer_v1 signer guidance'
rg -q 'COINBASE_KEY_ID' "${SKILL_FILE}" "${USAGE_FILE}" || fail 'missing key id guidance'
rg -q 'COINBASE_PRIVATE_KEY' "${SKILL_FILE}" "${USAGE_FILE}" || fail 'missing private key guidance'
rg -q 'uxc auth binding match https://api.coinbase.com/api/v3/brokerage/accounts' "${SKILL_FILE}" || fail 'missing binding match check'
rg -q 'high-risk writes' "${SKILL_FILE}" || fail 'missing high-risk write guidance'

if rg -q -- "--args\\s+'\\{" "${SKILL_FILE}" "${USAGE_FILE}"; then

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/validate.sh (reported line 38)May include surrounding context.

sh
rg -q 'jwt_bearer_v1' "${SKILL_FILE}" "${USAGE_FILE}" || fail 'missing jwt_bearer_v1 signer guidance'
rg -q 'COINBASE_KEY_ID' "${SKILL_FILE}" "${USAGE_FILE}" || fail 'missing key id guidance'
rg -q 'COINBASE_PRIVATE_KEY' "${SKILL_FILE}" "${USAGE_FILE}" || fail 'missing private key guidance'
rg -q 'uxc auth binding match https://api.coinbase.com/api/v3/brokerage/accounts' "${SKILL_FILE}" || fail 'missing binding match check'
rg -q 'high-risk writes' "${SKILL_FILE}" || fail 'missing high-risk write guidance'

if rg -q -- "--args\\s+'\\{" "${SKILL_FILE}" "${USAGE_FILE}"; then

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
55% confidence
Finding

Natural-language policy violations apply to all file types, including config files. The human-readable title and description are only provided in English and do not mention any language choice or locale behavior, which may conflict with an organizational policy requiring user language opt-in when a skill presents user-facing text.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.