clawchain plugin for impossible finance

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:10 PM UTC
• Version: 1.0.0

Overview

The skill is a disclosed crypto-trading helper, but it stores an unencrypted wallet key and gives the agent durable authority to sign and send swaps without clear per-trade approval.

Install only if you intend to let an agent manage a dedicated low-value BSC trading wallet. Before use, require manual approval for every approval or swap, pin and review dependencies, create the wallet file with 0600 permissions or use an encrypted keystore, and never fund it with assets you cannot afford to lose.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: skills.md:52
• Finding: Wallet Private Key Created Without Enforced Restrictive Permissions<![CDATA[ ## Vulnerability Details **File Location**: `skills.md:52-62` **Vulnerability Type**: Plaintext sensitive data stored with umask-dependent permissions **Risk Level**: High ### Vulnerable Code ```javascript const wallet = ethers.Wallet.createRandom(); const dir = process.env.HOME + '/.config/impossible_agent'; fs.mkdirSync(dir, { recursive: true }); const file = dir + '/wallet.json'; fs.writeFileSync(file, JSON.stringify({ privateKey: wallet.privateKey, address: wallet.address, publicKey: wallet.publicKey }, null, 2)); console.log('Wallet saved to ' + file); console.log('Address: ' + wallet.address); ``` ### Technical Analysis The generated `wallet.json` contains an unencrypted BSC private key. The creation code does not specify restrictive permissions for either the configuration directory or wallet file. Consequently, their permissions are inherited from the process umask and may allow other local users or processes to read the private key. Although `skills.md:330` later recommends running: ```bash chmod 600 ~/.config/impossible_agent/wallet.json ``` this is advisory rather than enforced by the wallet-generation procedure. The key may therefore remain exposed indefinitely, or during the interval between its creation and the manual permission change. ### Attack Path 1. The user runs the documented wallet-generation script. 2. The script writes an unencrypted private key to `~/.config/impossible_agent/wallet.json`. 3. A permissive process umask causes the directory or file to be readable by another local account or process. 4. The attacker reads and copies the private key. 5. The attacker imports the key into another wallet or signing tool. 6. The attacker signs arbitrary BSC transactions and transfers the wallet's BNB and BEP-20 assets. This path requires local filesystem access under permissions that permit reading the generated file; the code does not itself transmit the private key externally. ### Impact Assessment Disclosure of ...[truncated 491 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Create the wallet directory with mode `0700`. - Create the wallet file atomically with mode `0600` rather than relying on a later manual command. - Refuse to use the wallet if ownership or permissions are unsafe. - Prefer an encrypted keystore or operating-system-backed secret store over an unencrypted JSON private key. - Avoid replacing an existing wallet file unless the user explicitly confirms the operation. - Keep the documented recommendation to use a dedicated, low-value wallet. A hardened implementation could use: ```javascript fs.mkdirSync(dir, { recursive: true, mode: 0o700 }); const walletJson = JSON.stringify({ privateKey: wallet.privateKey, address: wallet.address, publicKey: wallet.publicKey }, null, 2); fs.writeFileSync(file, walletJson, { mode: 0o600, flag: 'wx' }); fs.chmodSync(dir, 0o700); fs.chmodSync(file, 0o600); ``` The `wx` flag prevents accidental replacement of an existing wallet. Production use should additionally consider encrypting the private key with a user-supplied secret and minimizing the period for which decrypted key material remains in memory. ]]>

T08 · Insecure Dependencies

Warning

• Location: skills.md:30
• Finding: Unpinned Runtime Dependency Used for Wallet Generation and Transaction Signing<![CDATA[ ## Vulnerability Details **File Location**: `skills.md:30-34` **Vulnerability Type**: Unpinned security-sensitive dependency **Risk Level**: Medium ### Vulnerable Code ```bash npm install ethers # or: pnpm add ethers ``` ### Technical Analysis The instructions install `ethers` without an exact version or a committed lockfile. The resulting package and transitive dependency versions can change over time, making the installed code different from the version originally reviewed. This dependency executes in a security-sensitive context: it generates the wallet, handles the private key, constructs transactions, and signs blockchain operations. A compromised package release, compromised transitive dependency, or unexpected incompatible update could therefore access key material or manipulate transaction parameters. The package name is not a visible typo or dependency-confusion name, and the project does not demonstrate that the package is currently malicious. The finding concerns mutable, unverified supply-chain resolution for a component trusted with financial credentials. ### Attack Path 1. The user follows the instructions and runs the unpinned installation command. 2. The package manager resolves the latest available `ethers` release and its current transitive dependencies. 3. A compromised or maliciously modified package version is downloaded, or an incompatible update introduces unsafe behavior. 4. The dependency executes during installation or when the wallet/trading scripts import it. 5. Malicious code reads the generated private key, changes transaction recipients or parameters, or leaks sensitive wallet data. 6. The attacker uses the exposed key or altered transaction to steal wallet assets. Successful exploitation depends on compromise or unsafe mutation of the resolved dependency chain; no such compromise is established by the audited file itself. ### Impact Assessment Because the dependency is entrusted with wallet creation and sign ...[truncated 453 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin `ethers` to an audited exact version rather than using an unconstrained installation. - Commit the appropriate lockfile and require deterministic installation with `npm ci` or `pnpm install --frozen-lockfile`. - Review dependency integrity metadata and audit the resolved dependency tree before use. - Run package installation and wallet operations under a dedicated, minimally privileged account. - Disable unnecessary package lifecycle scripts where operationally feasible. - Establish a controlled process for testing and approving dependency upgrades. For example: ```json { "dependencies": { "ethers": "6.x.y" } } ``` Replace `6.x.y` with the exact reviewed release, commit the generated lockfile, and install with: ```bash npm ci ``` The lockfile and exact version should be updated only after reviewing release changes and rerunning security checks. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill explicitly instructs generating a wallet and storing the raw private key unencrypted on disk in a predictable path. Even with a later note to keep the file secret, this creates a durable secret-at-rest exposure: any local compromise, logs/backups, or overly broad file permissions can lead to immediate theft of all wallet funds and abuse of the linked identity.

Credential Access

High

• Category: Privilege Escalation

Content

56 \
  "$ADDRESS" \
  --ft-auth \
  --secret ~/.config/clawchain/credentials.json \
  -brid $CLAWCHAIN_BRID \
  --api-url $CLAWCHAIN_NODE \
  --await

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

| USDT | `0x55d398326f99059fF775485246999027B3197955` | Stablecoin |
| BUSD | `0xe9e7CEA3DedcA5984780Bafc599bD69ADd087D56` | Stablecoin |
| IF | `0xb0e1fc65c1a741b4662b813eb787d369b8614af1` | Impossible Finance governance token |
| IDIA | `0x0b15Ddf19D47E6a86A56148fb4aFFFc6929BcB89` | Impossible Decentralized Incubator Access token |

**Do not limit to these.** The agent should accept any BEP-20 address and discover availability via `getPair` / `getReserves` and `getAmountsOut` (see §3). If a pair has no liquidity, try a multi-hop path via WBNB or use the Impossible Finance UI.

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Session Persistence

Medium

• Category: Rogue Agent

Content

# Impossible Finance Trading Skill

This skill lets the AI agent create a BSC wallet (private key + address saved in one file), **discover which tokens and swaps are available** on Impossible Finance DEX, swap tokens, and receive top-ups from the user. The agent is not limited to specific tokens — it can resolve token addresses and check which pairs have liquidity.

Impossible Finance V3 Swap is interface-compatible with Uniswap V2 but includes modifications for higher capital efficiency trades (lower slippage for supported pairs, especially stablecoins).

• Confidence: 82% confidence
• Finding: The skill is designed around persistent local storage of wallet material so the agent can reuse signing capability across sessions. In context, session persistence is dangerous because it preserves long-lived authority to move funds; once the host or file is compromised, the attacker gains continuing control over blockchain operations until the wallet is rotated.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The swap instructions describe building, signing, and broadcasting financial transactions without requiring explicit per-transaction user confirmation. In an agent context, that materially increases the risk of unintended or manipulated trades, especially because the skill also supports arbitrary token addresses and path discovery.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

## 7. Security Notes

- **wallet.json** contains the private key. Restrict access: `chmod 600 ~/.config/impossible_agent/wallet.json`.
- Use this wallet only for the agent and only with amounts you accept to lose if the machine or file is compromised.
- Prefer a dedicated BSC wallet; do not reuse a wallet that holds large funds elsewhere.

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Scope Creep

Low

• Category: Excessive Agency

Content

# Impossible Finance Trading Skill

This skill lets the AI agent create a BSC wallet (private key + address saved in one file), **discover which tokens and swaps are available** on Impossible Finance DEX, swap tokens, and receive top-ups from the user. The agent is not limited to specific tokens — it can resolve token addresses and check which pairs have liquidity.

Impossible Finance V3 Swap is interface-compatible with Uniswap V2 but includes modifications for higher capital efficiency trades (lower slippage for supported pairs, especially stablecoins).

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.