ClawHub
Back to skill

Security audit

cetus

Security checks for vulnerabilities and agentic risk

Overview

This skill is mainly a Cetus DeFi SDK guide, but it needs review because it includes live on-chain transaction examples with weak safety framing and a README that exposes unrelated development notes.

Review before installing. Use this only as a documentation/reference skill, verify the Cetus and ClawHub package sources, prefer testnet or simulation first, and do not let an agent submit transactions with a real keyPair unless you have reviewed the payload, amounts, assets, slippage, and irreversibility yourself. The README should be cleaned to remove the pasted development transcript and local environment details.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (11)

Agent Config Directory Access

High
Category
Agent Snooping
Confidence
98% confidence
Finding

The README explicitly discloses a .claude/settings.local.json path and then describes its permissions, including allowed git status and WebFetch access. Even though this is documentation text rather than the config file itself, exposing agent configuration locations and permission details meaningfully increases the attack surface by revealing how the developer's agent environment is constrained and what capabilities are available.

Content

Scanner excerpt · README.md (reported line 81)May include surrounding context.

md
## 使用方式
            完整 API 參考與範例請見 SKILL.md。
            ```
        - `/Users/k66/cetus/.claude/settings.local.json` (147 bytes)
          - Claude Code local project permissions
          - Allows `git status` in this directory and WebFetch from `raw.githubusercontent.com`
          - Content:

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The README exposes prior conversation content, local filesystem paths like /Users/k66/cetus/..., and references to local configuration details without any need for end users. This is an information disclosure issue: it leaks developer environment structure and internal workflow details that could aid social engineering, fingerprinting, or privacy compromise.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The example directly executes a signed on-chain transaction using a key pair without any warning that it will broadcast a live transaction and may move funds or create irreversible state changes. In a DeFi SDK integration guide, readers may copy-paste snippets verbatim, so omission of safety context increases the risk of accidental real-asset loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The DCA example uses sendTransaction with a signing key, which submits a real blockchain transaction, but the documentation does not warn the user that this can open, modify, or close live DCA positions with financial consequences. Because the skill is an operational DeFi guide, the missing warning makes accidental execution more likely and therefore materially unsafe.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The common transaction execution section presents generic copy-paste patterns for executeTx and sendTransaction without any universal caution about irreversible blockchain effects, key usage, or asset movement. Since this section is framed as a reusable pattern across all SDK modules, the unsafe omission propagates broadly and can normalize direct signing and submission in production contexts without adequate safeguards.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README for a public skill embeds a large unrelated Claude conversation transcript, including development history and operational details that do not belong in user-facing documentation. This creates prompt-surface contamination for agent tooling that ingests README content as instructions or context, increasing the risk of confusion, unintended behavior, or trust in irrelevant embedded material.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.