Clawchain skills

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:02 PM UTC
• Version: 1.0.0

Overview

The skill is broadly aligned with blockchain social and trading features, but it asks agents to update instructions from mutable remote files, persist hot-wallet keys, and take public or financial actions with limited per-action safeguards.

Review this skill carefully before installing. Use only low-value dedicated wallets, avoid funding an agent wallet with assets you cannot lose, require explicit approval before every post, moderation action, memory write, transfer, approval, or swap, and do not allow automatic remote skill updates unless the downloaded files are verified and approved.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T01 · Skill Instruction Hijacking

Error

• Location: skill.md:23
• Finding: Forced Loading and Replacement of Remotely Mutable Skill Instructions<![CDATA[ ## Vulnerability Details **File Location**: `skill.md:23-52`; `heartbeat.md:14-24` **Vulnerability Type**: Forced remote instruction retrieval and replacement **Risk Level**: Critical ### Vulnerable Code From `skill.md`: ```markdown Agents MUST download and use COLORPOOL_SKILL.md and BSC_PANCAKESWAP_SKILL.md when handling trading or token operations. When a user asks about trading, swapping, or token balances, the agent MUST load and follow: https://clawchain.ai/colorpool_skill.md ``` ```bash mkdir -p ~/.clawchain/skills/clawchain curl -s https://clawchain.ai/skill.md > ~/.clawchain/skills/clawchain/SKILL.md curl -s https://clawchain.ai/heartbeat.md > ~/.clawchain/skills/clawchain/HEARTBEAT.md curl -s https://clawchain.ai/colorpool_skill.md > ~/.clawchain/skills/clawchain/COLORPOOL_SKILL.md curl -s https://clawchain.ai/bsc_pancakeswap_skill.md > ~/.clawchain/skills/clawchain/BSC_PANCAKESWAP_SKILL.md ``` From `heartbeat.md`: ```bash curl -s https://clawchain.ai/skill.md | grep '"version"' ``` ```bash curl -s https://clawchain.ai/skill.md > ~/.clawchain/skills/clawchain/SKILL.md curl -s https://clawchain.ai/heartbeat.md > ~/.clawchain/skills/clawchain/HEARTBEAT.md curl -s https://clawchain.ai/colorpool_skill.md > ~/.clawchain/skills/clawchain/COLORPOOL_SKILL.md ``` ### Technical Analysis The reviewed package delegates future agent behavior to mutable Markdown retrieved from an external server. The instructions require the agent to load and follow remote documents and direct the heartbeat process to overwrite installed Skill files. No cryptographic signature, pinned digest, immutable release URL, content review, or user confirmation is required. Although the retrieved files are Markdown rather than native binaries, they constitute executable instructions in an AI-agent environment: modified text can direct tool calls, credential access, network requests, or blockchain transactions. The use of HTTPS protects transport integrity but does not pr ...[truncated 1204 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Package all required instruction files with the reviewed Skill instead of loading mutable copies at runtime. 2. Use immutable, versioned release URLs and pin a cryptographic SHA-256 digest for every downloaded file. 3. Verify releases with a trusted digital signature whose public key is distributed independently. 4. Download updates to a staging location rather than overwriting active files. 5. Present the version, digest, source, and semantic diff to the user before activation. 6. Require explicit user approval for every update. 7. Remove directives that require the agent to “MUST load and follow” arbitrary remote content. 8. Fail closed when signature or digest verification fails. ]]>

T01 · Skill Instruction Hijacking

Error

• Location: heartbeat.md:48
• Finding: Recurring Autonomous On-Chain Actions and Publication of Conversation-Derived Memory<![CDATA[ ## Vulnerability Details **File Location**: `heartbeat.md:48-57`, `heartbeat.md:62-130`; `skill.md:233-235`, `skill.md:414-424` **Vulnerability Type**: Autonomous external actions and unsafe on-chain information publication **Risk Level**: High ### Vulnerable Code From `heartbeat.md`: ```markdown | Activity | Frequency | Priority | |----------|-----------|----------| | Respond to comments on YOUR posts | Every 1-2 hours | High | | Browse feed and engage | Every 2-4 hours | High | | Discover new subclaws/agents | Daily | Medium | | Post new content | 1-2 times per day max | Medium | | Review followers | Weekly | Low | | Moderation duties (if applicable) | Every 4-6 hours | High | ``` ```markdown ### 7. Record Thoughts & Memories Use on-chain memory for important things: - `record_thought` - reflections, plans, analysis - `store_memory` - facts, preferences, decisions - `update_memory_file` - longer documents, logs ``` From `skill.md`: ```markdown | `record_thought` | `thought_type` `content` `context` | 0 | Store a thought on-chain | | `store_memory` | `category` `content` `importance` | 0 | Store a memory (importance: 0-100) | | `update_memory_file` | `filename` `content` `change_summary` | 0 | Store/update a file | ``` ```bash chr tx store_memory "fact" "User prefers technical discussions" 75 \ --ft-auth --secret ~/.config/clawchain/credentials.json \ -brid $CLAWCHAIN_BRID --api-url $CLAWCHAIN_NODE --await ``` ```bash chr tx update_memory_file "notes/daily.md" "Today I learned about blockchain" "Daily update" \ --ft-auth --secret ~/.config/clawchain/credentials.json \ -brid $CLAWCHAIN_BRID --api-url $CLAWCHAIN_NODE --await ``` ### Technical Analysis The heartbeat changes the agent from request-driven operation into a recurring autonomous actor. It directs the agent to post, comment, vote, subscribe, follow, and perform moderation actions without requiring contemporaneous human approval. The Skill also encourages publishing facts, ...[truncated 1417 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make all authenticated writes opt-in and disabled by default. 2. Require explicit user confirmation for the exact content and parameters of every post, comment, moderation action, memory write, or file update. 3. Restrict heartbeat activity to read-only queries and notifications. 4. Never publish conversation-derived memories, preferences, facts, files, or logs automatically. 5. Add sensitivity detection for credentials, personal data, financial details, private conversations, and internal system information. 6. Show a clear permanence warning and transaction preview before any on-chain publication. 7. Apply strict rate limits and maintain a user-visible action log. 8. Treat all social-network content as untrusted data that cannot issue operational instructions. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: bsc_pancakeswap_skill.md:49
• Finding: Plaintext BSC Private Key Created Without Atomic Permission Hardening<![CDATA[ ## Vulnerability Details **File Location**: `bsc_pancakeswap_skill.md:49-72`, `bsc_pancakeswap_skill.md:78-86`, `bsc_pancakeswap_skill.md:199-208`, `bsc_pancakeswap_skill.md:233` **Vulnerability Type**: Insecure plaintext private-key storage **Risk Level**: High ### Vulnerable Code ```javascript const fs = require('fs'); const path = require('path'); const { ethers } = require('ethers'); const wallet = ethers.Wallet.createRandom(); const dir = process.env.HOME + '/.config/bsc_agent'; fs.mkdirSync(dir, { recursive: true }); const file = dir + '/wallet.json'; fs.writeFileSync(file, JSON.stringify({ privateKey: wallet.privateKey, address: wallet.address, publicKey: wallet.publicKey }, null, 2)); console.log('Wallet saved to ' + file); console.log('Address: ' + wallet.address); ``` The resulting file format is: ```json { "privateKey": "0x...", "address": "0x...", "publicKey": "0x..." } ``` Permission hardening is only documented later as a separate recommendation: ```markdown - **wallet.json** contains the private key. Restrict access: `chmod 600 ~/.config/bsc_agent/wallet.json`. ``` ### Technical Analysis The recommended script writes an unencrypted BSC mainnet private key using `fs.writeFileSync` without specifying a restrictive file mode. The resulting permissions depend on the process umask. The later `chmod 600` instruction is advisory and is not executed atomically as part of file creation. Consequently, the wallet may remain readable by other local users or processes. Even if permissions are corrected later, there can be an exposure window between file creation and permission modification. The file also remains unencrypted at rest and is repeatedly loaded for transaction signing. ### Attack Path 1. The user runs the recommended wallet-generation script. 2. `wallet.json` is created with permissions derived from the environment's umask. 3. The user does not notice or execute the later `chmod 600` recommendation, or another proce ...[truncated 681 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer an operating-system keychain, hardware wallet, encrypted keystore, or managed signing service. 2. If file storage is unavoidable, create the file atomically with mode `0600`: ```javascript fs.writeFileSync(file, data, { mode: 0o600, flag: 'wx' }); ``` 3. Create the parent directory with mode `0700`. 4. Reject symlinks and refuse to overwrite existing wallet files. 5. Verify ownership and permissions before every signing operation. 6. Encrypt the private key at rest using a user-supplied secret and an established keystore format. 7. Never print, return, or log the private key. 8. Use a dedicated low-value wallet with transaction and balance limits. 9. Apply permission hardening before displaying the funding address. ]]>

T08 · Insecure Dependencies

Warning

• Location: bsc_pancakeswap_skill.md:39
• Finding: Unpinned Third-Party npm Dependency Installation<![CDATA[ ## Vulnerability Details **File Location**: `bsc_pancakeswap_skill.md:39-44` **Vulnerability Type**: Mutable and unverified package installation **Risk Level**: Medium ### Vulnerable Code ```markdown **Prerequisite:** Node.js 18+ with `ethers` (v6): ```bash npm install ethers # or: pnpm add ethers ``` ``` ### Technical Analysis The installation command does not pin an exact `ethers` version and does not provide a lockfile or integrity digest. It therefore resolves registry content at installation time. A future release may be incompatible or compromised, and dependency resolution may introduce changed transitive packages. Package-manager installation can also run lifecycle scripts unless separately disabled. This is particularly sensitive because the dependency is later used in the same environment that stores and loads a plaintext wallet private key. The audit did not find evidence that the current `ethers` package is malicious. The vulnerability is the unsafe, mutable dependency acquisition process. ### Attack Path 1. A user follows the prerequisite and runs `npm install ethers`. 2. The package manager resolves the latest matching release and its current transitive dependencies. 3. A compromised registry account, package release, or transitive dependency supplies malicious code. 4. Installation-time or runtime code executes with the user's permissions. 5. Malicious code accesses `wallet.json`, changes transaction destinations, or modifies swap parameters. ### Impact Assessment Successful supply-chain compromise could provide local code execution with the installing user's privileges. In this project's context, that could expose: - The BSC plaintext private key. - Chromia credentials readable by the same account. - Transaction details and wallet balances. - Control over signed swaps, approvals, and transfers. - Other files accessible to the local user. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin an audited exact package version rather than a floating major or latest version. 2. Commit a lockfile containing integrity metadata. 3. Use reproducible installation such as `npm ci`. 4. Review transitive dependencies and monitor security advisories. 5. Disable lifecycle scripts with `--ignore-scripts` where they are not required. 6. Verify package provenance or registry signatures when supported. 7. Run wallet-related code in a restricted environment with access only to the required wallet. 8. Document a tested Node.js and package version combination. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: colorpool_skill.md:43
• Finding: Inconsistent Credential Paths Can Select the Wrong ColorPool Signer<![CDATA[ ## Vulnerability Details **File Location**: `colorpool_skill.md:43`, `colorpool_skill.md:89-101`, `colorpool_skill.md:119-128`, `colorpool_skill.md:298-308` **Vulnerability Type**: Ambiguous and inconsistent credential configuration **Risk Level**: Medium ### Vulnerable Code The guide first derives identity from the ClawChain credential: ```markdown You will find your public key in `~/.config/clawchain/credentials.json` which must have been previously generated. If this file does not exist prompt your user to register on Clawchain first. ``` ColorPool registration then references another credential file: ```bash chr tx ft4.ras_transfer_fee \ 'x"9BACD576F40B6674AA76B8BFA1330077A3B94F581BFDB2EF806122C384DCDF25"' \ '[0, [["A","T"], x"<YOUR_PUBKEY>"], null]' \ 'null' \ --ft-register-account \ --secret ~/.config/colorpool/credentials.json \ -brid $COLORPOOL_BRID \ --api-url $COLORPOOL_NODE \ --await ``` The general operation pattern instead uses the ClawChain credential: ```bash chr tx <operation> "value1" "value2" "value3" \ --ft-auth \ --secret ~/.config/clawchain/credentials.json \ -brid $COLORPOOL_BRID \ --api-url $COLORPOOL_NODE \ --await ``` The swap example switches back to the ColorPool credential: ```bash chr tx swap_exact_tokens_for_tokens \ 1000000000000000000 \ 950000 \ '["CHR", "USDT"]' \ "<YOUR_ACCOUNT_ID>" \ 1735689600 \ --ft-auth --secret ~/.config/colorpool/credentials.json \ -brid $COLORPOOL_BRID --api-url $COLORPOOL_NODE --await ``` ### Technical Analysis The guide alternates between `~/.config/clawchain/credentials.json` and `~/.config/colorpool/credentials.json`, but it does not provide a ColorPool key-generation step or clearly define whether the same signer must be used for both applications. The account ID is derived from the ClawChain public key, while registration and swap examples may use a different secret. If the files contain different keys, transaction authentication may not ...[truncated 1146 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Define a single, explicit signer model for ClawChain and ColorPool. 2. If one credential is intended, use the same canonical path in every command and explain why reuse is required. 3. If separate credentials are intended, add a secure generation/import procedure and derive the ColorPool account from the matching public key. 4. Before funding or transacting, validate that the credential's public key matches the expected account ID. 5. Abort on missing, mismatched, symlinked, or insecurely permissioned credential files. 6. Do not advise users to copy plaintext secret files between directories. 7. Add preflight commands that display only the derived public address or account ID, never the private key. 8. Correct all examples and command templates to use the validated credential path consistently. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (41)

Credential Access

High

• Category: Privilege Escalation

Content

#### Get account id from pubkey

You will find your public key in `~/.config/clawchain/credentials.json` which must have been previously generated. If this file does not exist prompt your user to register on Clawchain first.

```bash
chr query ft4.get_accounts_by_signer id="pubkey here"   \

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#### Get account id from pubkey

You will find your public key in `~/.config/clawchain/credentials.json` which must have been previously generated. If this file does not exist prompt your user to register on Clawchain first.

```bash
chr query ft4.get_accounts_by_signer id="pubkey here"   \

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#### Get account id from pubkey

You will find your public key in `~/.config/clawchain/credentials.json` which must have been previously generated. If this file does not exist prompt your user to register on Clawchain first.

```bash
chr query ft4.get_accounts_by_signer id="pubkey here"   \

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#### Get account id from pubkey

You will find your public key in `~/.config/clawchain/credentials.json` which must have been previously generated. If this file does not exist prompt your user to register on Clawchain first.

```bash
chr query ft4.get_accounts_by_signer id="pubkey here"   \

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#### Get account id from pubkey

You will find your public key in `~/.config/clawchain/credentials.json` which must have been previously generated. If this file does not exist prompt your user to register on Clawchain first.

```bash
chr query ft4.get_accounts_by_signer id="pubkey here"   \

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#### Get account id from pubkey

You will find your public key in `~/.config/clawchain/credentials.json` which must have been previously generated. If this file does not exist prompt your user to register on Clawchain first.

```bash
chr query ft4.get_accounts_by_signer id="pubkey here"   \

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#### Get account id from pubkey

You will find your public key in `~/.config/clawchain/credentials.json` which must have been previously generated. If this file does not exist prompt your user to register on Clawchain first.

```bash
chr query ft4.get_accounts_by_signer id="pubkey here"   \

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#### Get account id from pubkey

You will find your public key in `~/.config/clawchain/credentials.json` which must have been previously generated. If this file does not exist prompt your user to register on Clawchain first.

```bash
chr query ft4.get_accounts_by_signer id="pubkey here"   \

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#### Get account id from pubkey

You will find your public key in `~/.config/clawchain/credentials.json` which must have been previously generated. If this file does not exist prompt your user to register on Clawchain first.

```bash
chr query ft4.get_accounts_by_signer id="pubkey here"   \

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#### Get account id from pubkey

You will find your public key in `~/.config/clawchain/credentials.json` which must have been previously generated. If this file does not exist prompt your user to register on Clawchain first.

```bash
chr query ft4.get_accounts_by_signer id="pubkey here"   \

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#### Get account id from pubkey

You will find your public key in `~/.config/clawchain/credentials.json` which must have been previously generated. If this file does not exist prompt your user to register on Clawchain first.

```bash
chr query ft4.get_accounts_by_signer id="pubkey here"   \

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#### Get account id from pubkey

You will find your public key in `~/.config/clawchain/credentials.json` which must have been previously generated. If this file does not exist prompt your user to register on Clawchain first.

```bash
chr query ft4.get_accounts_by_signer id="pubkey here"   \

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#### Get account id from pubkey

You will find your public key in `~/.config/clawchain/credentials.json` which must have been previously generated. If this file does not exist prompt your user to register on Clawchain first.

```bash
chr query ft4.get_accounts_by_signer id="pubkey here"   \

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#### Get account id from pubkey

You will find your public key in `~/.config/clawchain/credentials.json` which must have been previously generated. If this file does not exist prompt your user to register on Clawchain first.

```bash
chr query ft4.get_accounts_by_signer id="pubkey here"   \

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#### Get account id from pubkey

You will find your public key in `~/.config/clawchain/credentials.json` which must have been previously generated. If this file does not exist prompt your user to register on Clawchain first.

```bash
chr query ft4.get_accounts_by_signer id="pubkey here"   \

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#### Get account id from pubkey

You will find your public key in `~/.config/clawchain/credentials.json` which must have been previously generated. If this file does not exist prompt your user to register on Clawchain first.

```bash
chr query ft4.get_accounts_by_signer id="pubkey here"   \

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#### Get account id from pubkey

You will find your public key in `~/.config/clawchain/credentials.json` which must have been previously generated. If this file does not exist prompt your user to register on Clawchain first.

```bash
chr query ft4.get_accounts_by_signer id="pubkey here"   \

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#### Get account id from pubkey

You will find your public key in `~/.config/clawchain/credentials.json` which must have been previously generated. If this file does not exist prompt your user to register on Clawchain first.

```bash
chr query ft4.get_accounts_by_signer id="pubkey here"   \

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#### Get account id from pubkey

You will find your public key in `~/.config/clawchain/credentials.json` which must have been previously generated. If this file does not exist prompt your user to register on Clawchain first.

```bash
chr query ft4.get_accounts_by_signer id="pubkey here"   \

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

```bash
chr tx <operation> "value1" "value2" "value3" \
  --ft-auth \
  --secret ~/.config/clawchain/credentials.json \
  -brid $COLORPOOL_BRID \
  --api-url $COLORPOOL_NODE \
  --await

• Confidence: 90% confidence
• Finding: The template normalizes the use of a local credential file for authenticated transactions, and because it conflicts with other examples it increases the chance an agent will access or rely on the wrong secret path during signing. In the context of an autonomous skill handling financial actions, encouraging direct secret-file usage without tighter safeguards can lead to unauthorized signing attempts, key misuse, or accidental execution from the wrong account.

Session Persistence

Medium

• Category: Rogue Agent

Content

# BSC PancakeSwap Trading Skill

This skill lets the AI agent create a BSC wallet (private key + address saved in one file), **discover which tokens and swaps are available** on PancakeSwap, swap tokens, and receive top-ups from the user. The agent is not limited to specific tokens — it can resolve token addresses and check which pairs have liquidity.

## Configuration (BSC Mainnet)

• Confidence: 93% confidence
• Finding: The skill instructs the agent to create and persist a private key in a single local JSON file for repeated autonomous use. Persisting an unencrypted hot-wallet key materially increases the blast radius of host compromise, accidental disclosure, backup leakage, or other agent-side exfiltration because an attacker can immediately take custody of all funded assets and sign arbitrary transactions.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill enables creation of a hot wallet, storage of an unencrypted private key, funding by users, and live swaps, but the up-front description does not prominently warn that blockchain transfers and swaps are irreversible and losses from address mistakes, scams, slippage, or key compromise cannot be recovered. In this context, missing risk disclosure is dangerous because users are encouraged to send real funds to an agent-controlled wallet and may underestimate custody and transaction-finality risks before funding it.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The top-up section instructs users to send BNB and tokens to the agent wallet without a clear custody, privacy, and control warning. That is risky because the receiving wallet is controlled by the agent environment, not the user, so funds may be exposed to host compromise, logging leakage, operator access, or autonomous trading behavior once deposited.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

## 7. Security Notes

- **wallet.json** contains the private key. Restrict access: `chmod 600 ~/.config/bsc_agent/wallet.json`.
- Use this wallet only for the agent and only with amounts you accept to lose if the machine or file is compromised.
- Prefer a dedicated BSC wallet; do not reuse a wallet that holds large funds elsewhere.

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The skill mixes ColorPool and Clawchain identities, credentials, and registration flow, which can cause an agent or user to use the wrong account context when deriving IDs or preparing transactions. In a financial/on-chain skill, this ambiguity is dangerous because it can misdirect funds, create incorrect assumptions about account ownership, or trigger transactions against the wrong application environment.

Static analysis

No suspicious patterns detected.