T09 · Insecure Skill Coding Practices
Error
- Location
skills.md:52- Finding
Wallet Private Key Created Without Enforced Restrictive Permissions
- Content
View full analysis
- Remediation
View remediation
Security audit
clawchain plugin for impossible finance
Security checks for vulnerabilities and agentic risk
Overview
The skill is a disclosed crypto-trading helper, but it stores an unencrypted wallet key and gives the agent durable authority to sign and send swaps without clear per-trade approval.
Install only if you intend to let an agent manage a dedicated low-value BSC trading wallet. Before use, require manual approval for every approval or swap, pin and review dependencies, create the wallet file with 0600 permissions or use an encrypted keystore, and never fund it with assets you cannot afford to lose.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
skills.md:30- Finding
Unpinned Runtime Dependency Used for Wallet Generation and Transaction Signing
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill explicitly instructs generating a wallet and storing the raw private key unencrypted on disk in a predictable path. Even with a later note to keep the file secret, this creates a durable secret-at-rest exposure: any local compromise, logs/backups, or overly broad file permissions can lead to immediate theft of all wallet funds and abuse of the linked identity.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 56 \ "$ADDRESS" \ --ft-auth \ --secret ~/.config/clawchain/credentials.json \ -brid $CLAWCHAIN_BRID \ --api-url $CLAWCHAIN_NODE \ --await
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md | USDT | `0x55d398326f99059fF775485246999027B3197955` | Stablecoin | | BUSD | `0xe9e7CEA3DedcA5984780Bafc599bD69ADd087D56` | Stablecoin | | IF | `0xb0e1fc65c1a741b4662b813eb787d369b8614af1` | Impossible Finance governance token | | IDIA | `0x0b15Ddf19D47E6a86A56148fb4aFFFc6929BcB89` | Impossible Decentralized Incubator Access token | **Do not limit to these.** The agent should accept any BEP-20 address and discover availability via `getPair` / `getReserves` and `getAmountsOut` (see §3). If a pair has no liquidity, try a multi-hop path via WBNB or use the Impossible Finance UI.
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 82% confidence
- Finding
The skill is designed around persistent local storage of wallet material so the agent can reuse signing capability across sessions. In context, session persistence is dangerous because it preserves long-lived authority to move funds; once the host or file is compromised, the attacker gains continuing control over blockchain operations until the wallet is rotated.
- Content
md # Impossible Finance Trading Skill This skill lets the AI agent create a BSC wallet (private key + address saved in one file), **discover which tokens and swaps are available** on Impossible Finance DEX, swap tokens, and receive top-ups from the user. The agent is not limited to specific tokens — it can resolve token addresses and check which pairs have liquidity. Impossible Finance V3 Swap is interface-compatible with Uniswap V2 but includes modifications for higher capital efficiency trades (lower slippage for supported pairs, especially stablecoins).
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The swap instructions describe building, signing, and broadcasting financial transactions without requiring explicit per-transaction user confirmation. In an agent context, that materially increases the risk of unintended or manipulated trades, especially because the skill also supports arbitrary token addresses and path discovery.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md ## 7. Security Notes - **wallet.json** contains the private key. Restrict access: `chmod 600 ~/.config/impossible_agent/wallet.json`. - Use this wallet only for the agent and only with amounts you accept to lose if the machine or file is compromised. - Prefer a dedicated BSC wallet; do not reuse a wallet that holds large funds elsewhere.
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 70% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
md # Impossible Finance Trading Skill This skill lets the AI agent create a BSC wallet (private key + address saved in one file), **discover which tokens and swaps are available** on Impossible Finance DEX, swap tokens, and receive top-ups from the user. The agent is not limited to specific tokens — it can resolve token addresses and check which pairs have liquidity. Impossible Finance V3 Swap is interface-compatible with Uniswap V2 but includes modifications for higher capital efficiency trades (lower slippage for supported pairs, especially stablecoins).