OpenScan Crypto

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:20 AM UTC
• Version: 1.0.0

Overview

This is a read-only blockchain lookup skill, but its private mode is not consistently enforced and installation pulls mutable npm code.

Install only if you are comfortable with read-only blockchain lookups being sent to public RPC and indexing services. Do not rely on --private for full privacy until the ENS and price paths enforce it consistently, and avoid running the installer with elevated privileges because dependencies are resolved at install time.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/crypto-cli.mjs:1220

Finding

The --private privacy restriction is bypassed by price and ENS helper operations

Content

View full analysis

Remediation

View remediation

rpc.tracking === "none"); } if (privateOnly && rpcs.length === 0) { throw new Error(`No private (tracking:none) RPCs configured for chain ${chainId}`); } return rpcs[0]?.url || null; } ``` 2. Forward `privateOnly` from `cmdPrice`: ```js const rpcUrl = await getRpcUrlForChain(chainId, privateOnly); const mainnetRpc = ETH_NATIVE_CHAINS.has(chainId) ? await getRpcUrlForChain(1, privateOnly) : null; ``` 3. Add a `privateOnly` parameter to `resolveENS` and `reverseENS`, and pass it into `getEvmClient("ethereum", privateOnly)`. 4. Propagate the flag from every command router call before ENS resolution. Avoid resolving ENS in a separate pre-command path that silently uses default provider selection. 5. Fail closed when `--private` is requested and no `tracking: "none"` endpoint is available. Do not silently fall back to another provider. 6. Add automated tests that intercept network requests and verify every documented `--private` command contacts only endpoints classified as `tracking: "none"`. ]]>

T08 · Insecure Dependencies

Warning

• Location: install.sh:1

Finding

Dependency installation is mutable and executes lifecycle-enabled npm installation without a lockfile

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

Yes, this is a mismatch for the provided code chunk. The description claims the skill can query balances, blocks, transactions, gas prices, mempool data, token metadata, RPC endpoints, and ENS across multiple chains. However, the only supplied code is an install.sh script whose behavior is limited to running npm install in the local directory. That is a generic setup step, not the declared primary functionality. While installation can be a supporting implementation detail, the chunk itself does not evidence the described crypto-query behavior, so the supplied code does not accurately represent the declared purpose.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README says the skill becomes available automatically and users can 'ask naturally,' with examples spanning many blockchain tasks. This creates broad, ambiguous activation boundaries, increasing the chance the agent invokes the skill for loosely related prompts and sends user-supplied blockchain identifiers or queries to external OpenScan infrastructure without sufficiently explicit user intent. In this context the skill is read-only, which limits direct asset risk, but unintended external data disclosure and overuse of third-party network access remain real concerns.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill clearly instructs the agent to use network-capable functionality against external RPC, CDN, npm metadata resolution, ENS, and mempool.space endpoints, but it declares no explicit tool scope or permissions boundary. This creates a governance and containment gap: the agent may invoke network operations without an auditable allowlist, increasing the risk of unintended outbound requests and data disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill routes addresses, ENS names, transaction hashes, and potentially operator-supplied custom RPC URLs to external services, but the description does not clearly warn users about this data exposure. In a blockchain context, these identifiers can be sensitive because they reveal user interests, wallet associations, and investigative targets to third-party infrastructure providers.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The natural-language mapping contains broad triggers such as "Look up this transaction" and similar generic phrases that could fire on ordinary user requests without enough blockchain-specific context. Over-broad activation can cause the agent to send user-provided identifiers to third-party services unexpectedly, leading to privacy leakage and tool misuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The btc-address command sends a user-supplied Bitcoin address directly to mempool.space via a third-party REST request. Even though a Bitcoin address is public-chain data, this leaks the user's query intent, IP address, timing, and address interest to an external service without an explicit warning or consent at the call site, which is a real privacy issue for a crypto-focused tool.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The module header explicitly says it does not handle dynamic arrays, yet decodeParams contains a branch for type.endsWith("[]") that reads an offset, length, and decodes array elements. This is an active contradiction between the file documentation and implemented behavior, not merely an omission.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The function comment states it computes the 4-byte function selector, but the body performs a SHA-256 digest and then discards the result, returning null unconditionally. The inline comment acknowledges this is only a placeholder, which contradicts the function's documented purpose.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency is specified with a caret range, which allows newer compatible releases to be installed automatically. If the upstream package or one of its transitive dependencies is compromised or introduces a breaking security regression, builds may silently pull the affected version and expose the skill to supply-chain compromise.

Content

Scanner excerpt · package.json (reported line 7)May include surrounding context.

json

"description": "OpenClaw skill for navigating crypto networks via OpenScan",
  "type": "module",
  "dependencies": {
    "@openscan/network-connectors": "^1.3.1"
  }
}

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

When a selector is not locally recognized, the code sends it to 4byte.directory, disclosing transaction metadata to a third party. While a 4-byte selector is limited information and often public or guessable, it can still reveal user interest in specific contract interactions and creates an unnecessary external data-sharing dependency without disclosure or consent. In a blockchain-query skill, this is somewhat more likely to occur during normal operation, which makes the privacy issue more relevant rather than less.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

This code performs network fetches to npm registry and jsDelivr to retrieve metadata and RPC endpoint data, but the behavior is only documented in developer-facing comments/docstrings. There is no confirmation prompt, logging, or other runtime user disclosure that external network requests will be made.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.