ClawHub
Back to skill

Security audit

Upbit OpenAPI Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed read-only helper for Upbit public market data and does not request credentials or hidden background access.

Before installing, confirm you are comfortable with a UXC-linked command that reads public Upbit market data from the selected regional host and a GitHub-hosted schema URL. Do not add account/order credentials or private Upbit endpoints unless a separate reviewed signer flow is provided.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The declared purpose suggests the skill's function is to enable use of Upbit public market APIs via UXC with a curated schema and documented auth boundaries. However, the supplied code chunk does not implement API access or market discovery behavior. It only validates that certain local files exist and contain expected schema entries and documentation text. This is a materially different primary purpose from operating the exchange APIs, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.