Crypto Research Assistant

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:00 PM UTC
• Version: 1.0.0

Overview

This is a simple crypto research guidance skill; users should mainly be cautious about the mutable installer command and finance-domain limitations.

Before installing, prefer a pinned and reviewed clawhub package version instead of @latest, and treat outputs as research support rather than investment advice. The skill appears lightweight and disclosed, but its crypto trigger is broad, so users should ask for clearly scoped research or risk analysis.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned npm Package Execution Through a Mutable Version Tag

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 13
Vulnerability Type: Supply-chain risk caused by executing an unpinned third-party package
Risk Level: Medium

Vulnerable Code

bash

npx clawhub@latest install crypto-research-assistant

Technical Analysis

The installation instructions invoke npx with the mutable latest tag. This can cause npm to download and execute whichever clawhub package release is designated as latest at installation time. The command does not specify a reviewed, immutable package version or an integrity digest.

Consequently, the code executed by users may differ from the version that was originally assessed. Exploitation would require compromise or malicious control of the relevant npm package, its publishing account, or its dependency chain; the project itself does not contain a malicious payload.

Attack Path

1. An attacker compromises the clawhub publishing account, package, or applicable dependency chain.
2. The attacker publishes a malicious release and causes it to resolve through the latest tag.
3. A user follows the documented installation command.
4. npx retrieves and executes the attacker-controlled package.
5. The payload runs with the operating-system permissions and environmental access of the user who invoked the command.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the invoking user's account. Depending on that user's privileges and environment, the malicious package could access readable files, credentials exposed to the process, project data, network resources, and writable user-level configuration. Administrative or system-wide impact is possible only if the command is run with elevated privileges; no privilege-escalation mechanism is present in the reviewed file.

Remediation

View remediation

Remediation Suggestions

• Replace the mutable tag with an explicitly reviewed version, for example npx clawhub@X.Y.Z, after verifying that release.
• Prefer an installation workflow backed by a committed lockfile and npm integrity metadata where supported.
• Verify package provenance, publisher identity, signatures or attestations, and registry source before execution.
• Review the selected package version and its transitive dependencies for unexpected install scripts or executable behavior.
• Avoid running the command with administrative privileges and use a constrained environment with minimal credentials and filesystem access.
• Establish a controlled upgrade process in which newer versions are reviewed and tested before the pinned version is changed.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill description is written entirely in Traditional Chinese/Cantonese style, and the example interaction also assumes that language, with no indication that users may choose another language. Under the language/locale policy, a skill should not implicitly force a specific language unless it offers opt-in or clearly documents a justified region-specific limitation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The installation command uses npx clawhub@latest, which fetches and executes the newest published package version at install time instead of a reviewed, immutable release. This creates a supply-chain risk: if the package is compromised, typosquatted, or updated maliciously later, users may execute untrusted code simply by following the skill's instructions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The activation rule says to use the skill whenever users ask crypto-related questions, which is overly broad and can cause the assistant to invoke this specialized workflow for ordinary conversations without clear boundaries. In a finance-related domain, over-triggering increases the chance of irrelevant guidance, policy bypass through unintended tool usage, or users receiving investment-style analysis when they did not explicitly request it.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.