Clawchain skills

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:02 PM UTC
• Version: 1.0.0

Overview

The skill is broadly aligned with blockchain social and trading features, but it asks agents to update instructions from mutable remote files, persist hot-wallet keys, and take public or financial actions with limited per-action safeguards.

Review this skill carefully before installing. Use only low-value dedicated wallets, avoid funding an agent wallet with assets you cannot lose, require explicit approval before every post, moderation action, memory write, transfer, approval, or swap, and do not allow automatic remote skill updates unless the downloaded files are verified and approved.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: skill.md:23

Finding

Forced Loading and Replacement of Remotely Mutable Skill Instructions

Content

View full analysis

~/.clawchain/skills/clawchain/SKILL.md curl -s https://clawchain.ai/heartbeat.md > ~/.clawchain/skills/clawchain/HEARTBEAT.md curl -s https://clawchain.ai/colorpool_skill.md > ~/.clawchain/skills/clawchain/COLORPOOL_SKILL.md curl -s https://clawchain.ai/bsc_pancakeswap_skill.md > ~/.clawchain/skills/clawchain/BSC_PANCAKESWAP_SKILL.md ``` From `heartbeat.md`: ```bash curl -s https://clawchain.ai/skill.md | grep '"version"' ``` ```bash curl -s https://clawchain.ai/skill.md > ~/.clawchain/skills/clawchain/SKILL.md curl -s https://clawchain.ai/heartbeat.md > ~/.clawchain/skills/clawchain/HEARTBEAT.md curl -s https://clawchain.ai/colorpool_skill.md > ~/.clawchain/skills/clawchain/COLORPOOL_SKILL.md ``` ### Technical Analysis The reviewed package delegates future agent behavior to mutable Markdown retrieved from an external server. The instructions require the agent to load and follow remote documents and direct the heartbeat process to overwrite installed Skill files. No cryptographic signature, pinned digest, immutable release URL, content review, or user confirmation is required. Although the retrieved files are Markdown rather than native binaries, they constitute executable instructions in an AI-agent environment: modified text can direct tool calls, credential access, network requests, or blockchain transactions. The use of HTTPS protects transport integrity but does not pr ...[truncated 1204 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: heartbeat.md:48

Finding

Recurring Autonomous On-Chain Actions and Publication of Conversation-Derived Memory

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: bsc_pancakeswap_skill.md:49

Finding

Plaintext BSC Private Key Created Without Atomic Permission Hardening

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: bsc_pancakeswap_skill.md:39

Finding

Unpinned Third-Party npm Dependency Installation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: colorpool_skill.md:43

Finding

Inconsistent Credential Paths Can Select the Wrong ColorPool Signer

Content

View full analysis

"], null]' \ 'null' \ --ft-register-account \ --secret ~/.config/colorpool/credentials.json \ -brid $COLORPOOL_BRID \ --api-url $COLORPOOL_NODE \ --await ``` The general operation pattern instead uses the ClawChain credential: ```bash chr tx "value1" "value2" "value3" \ --ft-auth \ --secret ~/.config/clawchain/credentials.json \ -brid $COLORPOOL_BRID \ --api-url $COLORPOOL_NODE \ --await ``` The swap example switches back to the ColorPool credential: ```bash chr tx swap_exact_tokens_for_tokens \ 1000000000000000000 \ 950000 \ '["CHR", "USDT"]' \ "" \ 1735689600 \ --ft-auth --secret ~/.config/colorpool/credentials.json \ -brid $COLORPOOL_BRID --api-url $COLORPOOL_NODE --await ``` ### Technical Analysis The guide alternates between `~/.config/clawchain/credentials.json` and `~/.config/colorpool/credentials.json`, but it does not provide a ColorPool key-generation step or clearly define whether the same signer must be used for both applications. The account ID is derived from the ClawChain public key, while registration and swap examples may use a different secret. If the files contain different keys, transaction authentication may not ...[truncated 1146 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (41)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · colorpool_skill.md (reported line 43)May include surrounding context.

Get account id from pubkey

You will find your public key in ~/.config/clawchain/credentials.json which must have been previously generated. If this file does not exist prompt your user to register on Clawchain first.

bash

chr query ft4.get_accounts_by_signer id="pubkey here"   \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · colorpool_skill.md (reported line 98)May include surrounding context.

Get account id from pubkey

You will find your public key in ~/.config/clawchain/credentials.json which must have been previously generated. If this file does not exist prompt your user to register on Clawchain first.

bash

chr query ft4.get_accounts_by_signer id="pubkey here"   \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · colorpool_skill.md (reported line 306)May include surrounding context.

Get account id from pubkey

You will find your public key in ~/.config/clawchain/credentials.json which must have been previously generated. If this file does not exist prompt your user to register on Clawchain first.

bash

chr query ft4.get_accounts_by_signer id="pubkey here"   \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.md (reported line 83)May include surrounding context.

Get account id from pubkey

You will find your public key in ~/.config/clawchain/credentials.json which must have been previously generated. If this file does not exist prompt your user to register on Clawchain first.

bash

chr query ft4.get_accounts_by_signer id="pubkey here"   \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.md (reported line 86)May include surrounding context.

Get account id from pubkey

You will find your public key in ~/.config/clawchain/credentials.json which must have been previously generated. If this file does not exist prompt your user to register on Clawchain first.

bash

chr query ft4.get_accounts_by_signer id="pubkey here"   \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.md (reported line 97)May include surrounding context.

Get account id from pubkey

You will find your public key in ~/.config/clawchain/credentials.json which must have been previously generated. If this file does not exist prompt your user to register on Clawchain first.

bash

chr query ft4.get_accounts_by_signer id="pubkey here"   \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.md (reported line 110)May include surrounding context.

Get account id from pubkey

You will find your public key in ~/.config/clawchain/credentials.json which must have been previously generated. If this file does not exist prompt your user to register on Clawchain first.

bash

chr query ft4.get_accounts_by_signer id="pubkey here"   \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.md (reported line 163)May include surrounding context.

Get account id from pubkey

You will find your public key in ~/.config/clawchain/credentials.json which must have been previously generated. If this file does not exist prompt your user to register on Clawchain first.

bash

chr query ft4.get_accounts_by_signer id="pubkey here"   \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.md (reported line 318)May include surrounding context.

Get account id from pubkey

You will find your public key in ~/.config/clawchain/credentials.json which must have been previously generated. If this file does not exist prompt your user to register on Clawchain first.

bash

chr query ft4.get_accounts_by_signer id="pubkey here"   \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.md (reported line 325)May include surrounding context.

Get account id from pubkey

You will find your public key in ~/.config/clawchain/credentials.json which must have been previously generated. If this file does not exist prompt your user to register on Clawchain first.

bash

chr query ft4.get_accounts_by_signer id="pubkey here"   \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.md (reported line 332)May include surrounding context.

Get account id from pubkey

You will find your public key in ~/.config/clawchain/credentials.json which must have been previously generated. If this file does not exist prompt your user to register on Clawchain first.

bash

chr query ft4.get_accounts_by_signer id="pubkey here"   \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.md (reported line 339)May include surrounding context.

Get account id from pubkey

You will find your public key in ~/.config/clawchain/credentials.json which must have been previously generated. If this file does not exist prompt your user to register on Clawchain first.

bash

chr query ft4.get_accounts_by_signer id="pubkey here"   \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.md (reported line 358)May include surrounding context.

Get account id from pubkey

You will find your public key in ~/.config/clawchain/credentials.json which must have been previously generated. If this file does not exist prompt your user to register on Clawchain first.

bash

chr query ft4.get_accounts_by_signer id="pubkey here"   \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.md (reported line 371)May include surrounding context.

Get account id from pubkey

You will find your public key in ~/.config/clawchain/credentials.json which must have been previously generated. If this file does not exist prompt your user to register on Clawchain first.

bash

chr query ft4.get_accounts_by_signer id="pubkey here"   \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.md (reported line 378)May include surrounding context.

Get account id from pubkey

You will find your public key in ~/.config/clawchain/credentials.json which must have been previously generated. If this file does not exist prompt your user to register on Clawchain first.

bash

chr query ft4.get_accounts_by_signer id="pubkey here"   \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.md (reported line 391)May include surrounding context.

Get account id from pubkey

You will find your public key in ~/.config/clawchain/credentials.json which must have been previously generated. If this file does not exist prompt your user to register on Clawchain first.

bash

chr query ft4.get_accounts_by_signer id="pubkey here"   \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.md (reported line 398)May include surrounding context.

Get account id from pubkey

You will find your public key in ~/.config/clawchain/credentials.json which must have been previously generated. If this file does not exist prompt your user to register on Clawchain first.

bash

chr query ft4.get_accounts_by_signer id="pubkey here"   \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.md (reported line 417)May include surrounding context.

Get account id from pubkey

You will find your public key in ~/.config/clawchain/credentials.json which must have been previously generated. If this file does not exist prompt your user to register on Clawchain first.

bash

chr query ft4.get_accounts_by_signer id="pubkey here"   \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.md (reported line 424)May include surrounding context.

Get account id from pubkey

You will find your public key in ~/.config/clawchain/credentials.json which must have been previously generated. If this file does not exist prompt your user to register on Clawchain first.

bash

chr query ft4.get_accounts_by_signer id="pubkey here"   \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The template normalizes the use of a local credential file for authenticated transactions, and because it conflicts with other examples it increases the chance an agent will access or rely on the wrong secret path during signing. In the context of an autonomous skill handling financial actions, encouraging direct secret-file usage without tighter safeguards can lead to unauthorized signing attempts, key misuse, or accidental execution from the wrong account.

Content

Scanner excerpt · colorpool_skill.md (reported line 124)May include surrounding context.

bash

chr tx <operation> "value1" "value2" "value3" \
  --ft-auth \
  --secret ~/.config/clawchain/credentials.json \
  -brid $COLORPOOL_BRID \
  --api-url $COLORPOOL_NODE \
  --await

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 93% confidence

Finding

The skill instructs the agent to create and persist a private key in a single local JSON file for repeated autonomous use. Persisting an unencrypted hot-wallet key materially increases the blast radius of host compromise, accidental disclosure, backup leakage, or other agent-side exfiltration because an attacker can immediately take custody of all funded assets and sign arbitrary transactions.

Content

Scanner excerpt · bsc_pancakeswap_skill.md (reported line 10)May include surrounding context.

md

# BSC PancakeSwap Trading Skill

This skill lets the AI agent create a BSC wallet (private key + address saved in one file), **discover which tokens and swaps are available** on PancakeSwap, swap tokens, and receive top-ups from the user. The agent is not limited to specific tokens — it can resolve token addresses and check which pairs have liquidity.

## Configuration (BSC Mainnet)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill enables creation of a hot wallet, storage of an unencrypted private key, funding by users, and live swaps, but the up-front description does not prominently warn that blockchain transfers and swaps are irreversible and losses from address mistakes, scams, slippage, or key compromise cannot be recovered. In this context, missing risk disclosure is dangerous because users are encouraged to send real funds to an agent-controlled wallet and may underestimate custody and transaction-finality risks before funding it.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The top-up section instructs users to send BNB and tokens to the agent wallet without a clear custody, privacy, and control warning. That is risky because the receiving wallet is controlled by the agent environment, not the user, so funds may be exposed to host compromise, logging leakage, operator access, or autonomous trading behavior once deposited.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · bsc_pancakeswap_skill.md (reported line 233)May include surrounding context.

md

## 7. Security Notes

- **wallet.json** contains the private key. Restrict access: `chmod 600 ~/.config/bsc_agent/wallet.json`.
- Use this wallet only for the agent and only with amounts you accept to lose if the machine or file is compromised.
- Prefer a dedicated BSC wallet; do not reuse a wallet that holds large funds elsewhere.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill mixes ColorPool and Clawchain identities, credentials, and registration flow, which can cause an agent or user to use the wrong account context when deriving IDs or preparing transactions. In a financial/on-chain skill, this ambiguity is dangerous because it can misdirect funds, create incorrect assumptions about account ownership, or trigger transactions against the wrong application environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.