ClawHub
Back to skill

Security audit

stable-layer-sdk

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent Sui stablecoin SDK guide, but it needs review because it shows mainnet fund-affecting transactions and private-key signing without clear safety guardrails.

Review this before installing. Use pinned, verified package versions where possible, test on Sui testnet first, keep private keys out of source code and chat context, and require explicit human confirmation of contract addresses, token types, amounts, and network before any transaction is signed or submitted.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:8
Finding

Unpinned npm Dependencies in SDK Installation Instructions

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 8
Vulnerability Type: Unpinned third-party dependencies and mutable package resolution
Risk Level: Medium

Vulnerable Code:

bash
npm install stable-layer-sdk @mysten/sui @mysten/bcs

Technical Analysis

The installation command does not specify exact package versions or integrity hashes. npm therefore resolves package versions from mutable registry metadata at installation time. The project also provides no lockfile or vendored implementation that would allow the resolved SDK code to be verified as part of this audit.

If one of these packages, its publisher account, or the package registry delivery path is compromised, a malicious release could be installed instead of the version expected when the documentation was written. npm packages can execute lifecycle scripts during installation and subsequently run with the privileges of the user importing the package.

Attack Path

  1. An attacker compromises a listed package, publisher account, or relevant supply-chain component.
  2. The attacker publishes a malicious version that satisfies npm's default version resolution.
  3. A user follows the documented installation command.
  4. npm retrieves the malicious release and may execute its lifecycle scripts.
  5. Malicious package code executes under the user's account during installation or when the SDK is imported.
  6. The code may inspect accessible files, environment variables, wallet material, or alter the blockchain transaction-building workflow.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the installing user's privileges. The affected scope includes files, credentials, environment variables, and network resources accessible to that user. Because the documented workflow signs Sui blockchain transactions, a compromised dependency could also alter transaction parameters or attempt to capture sensitive ...[truncated 153 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin every dependency to an exact, reviewed version rather than relying on mutable registry resolution.
  • Commit a lockfile containing resolved versions and package integrity hashes.
  • Verify package publisher identities, provenance, release signatures, and source repositories before recommending installation.
  • Use npm ci with a reviewed lockfile for reproducible installation.
  • Disable lifecycle scripts with --ignore-scripts where package functionality permits, or explicitly review all required lifecycle scripts.
  • Use automated dependency monitoring and require security review before updating pinned versions.
  • Publish or include the SDK implementation needed to verify the transaction-building behavior.

T08 · Insecure Dependencies

Warning
Location
README.md:8
Finding

Unpinned npx Package Retrieval and Execution

Content
View full analysis

Vulnerability Details

File Location: README.md, line 8
Vulnerability Type: Unpinned package retrieval and execution through npx
Risk Level: Medium

Vulnerable Code:

bash
npx clawhub install stable-layer-sdk

Technical Analysis

The command invokes clawhub through npx without pinning a verified version. If the package is not already available locally, npx may retrieve the currently resolved package from the npm registry and execute it. The command also directs that tool to install stable-layer-sdk, whose version and integrity are likewise unspecified.

This creates two mutable supply-chain boundaries: the executable installer and the package selected by that installer. Neither artifact is accompanied by a version constraint, checksum, signature, lockfile, or verified publisher information in the project.

Attack Path

  1. An attacker compromises, replaces, or publishes a malicious version of the package resolved as clawhub, or compromises the package resolution for stable-layer-sdk.
  2. A user copies and executes the documented npx command.
  3. npx downloads and runs the resolved installer with the user's privileges.
  4. The installer retrieves or installs attacker-controlled content.
  5. Malicious code accesses resources available to the user or modifies the installed SDK.
  6. The compromised SDK may later execute while the user creates or signs financial transactions.

Impact Assessment

Exploitation could result in arbitrary code execution under the invoking user's account. Potentially exposed resources include project files, home-directory data, environment variables, development credentials, and locally accessible wallet information. A malicious installer or SDK could also manipulate transaction construction before the user signs a blockchain transaction. The audited files do not themselves contain an exfiltration mechanism, persistence logic, or malicious payload.

Remediation
View remediation

Remediation Suggestions

  • Pin the installer to an exact, independently verified version, for example by using an explicitly versioned package reference.
  • Pin stable-layer-sdk to an exact reviewed version in the installation workflow.
  • Publish checksums, signatures, provenance attestations, and verified repository links for both the installer and SDK.
  • Avoid executing registry-fetched tools directly where a locally installed, lockfile-controlled tool can be used instead.
  • Run installation in a restricted environment with no wallet secrets or unnecessary credentials available.
  • Document how users can inspect package contents and verify transaction parameters before signing.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The README instructs users to run npx clawhub install stable-layer-sdk without pinning a specific version of the package being executed. Unpinned npx execution can fetch and run whatever version is current at install time, which creates a supply-chain risk if the package is updated maliciously, compromised, or if users receive a different artifact than expected.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation describes mint, burn, and reward-claim transaction flows that directly affect on-chain assets, but it does not warn users that these are real blockchain operations with potentially irreversible financial consequences. In an agent skill context, omission of fund-movement warnings can lead users to run examples on mainnet without understanding the risk, especially when the examples normalize live transaction creation and execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The example shows constructing, signing, and executing a blockchain transaction with a private key on mainnet, yet it provides no warning about secure key handling or the possibility of spending real funds. In a reusable skill or SDK guide, this is dangerous because users may copy-paste the pattern, expose sensitive key material, or unintentionally execute live transactions against production assets.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.