T09 · Insecure Skill Coding Practices
Error
- Location
skills.md:50- Finding
Wallet Private Key Stored Without Enforced Access Controls
- Content
View full analysis
- Remediation
View remediation
Security audit
plugin skill for clawchain agent to use pancake exchange
Security checks for vulnerabilities and agentic risk
Overview
The skill is transparent about being a PancakeSwap trading tool, but it gives the agent persistent control of a funded wallet without enforced key protection or required per-trade confirmation.
Install only if you are comfortable giving the agent control over a dedicated, low-balance BSC wallet. Do not reuse an important wallet, prefer testnet first, secure the key file before funding it, and require the agent to show and wait for your explicit approval before every token approval, swap, or transfer.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
skills.md:41- Finding
Unpinned Third-Party Dependency Installation
- Content
View full analysis
- Remediation
View remediation
npm ci ``` The project should: 1. Declare the reviewed exact version in `package.json` rather than using a floating range. 2. Commit `package-lock.json` or the equivalent `pnpm-lock.yaml` with integrity information. 3. Instruct users and automation to use `npm ci` or `pnpm install --frozen-lockfile`. 4. Review the selected package version and its transitive dependency tree before release. 5. Use trusted registry configuration and verify package provenance where supported. 6. Disable dependency lifecycle scripts with `--ignore-scripts` when they are not required. 7. Run installation and wallet operations under a dedicated, least-privileged operating-system account. 8. Perform automated dependency and provenance checks before updating the pinned version. 9. Separate dependency installation from environments containing funded wallets or unrelated credentials. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md 56 \ "$ADDRESS" \ --ft-auth \ --secret ~/.config/clawchain/credentials.json \ -brid $CLAWCHAIN_BRID \ --api-url $CLAWCHAIN_NODE \ --await
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The skill is explicitly built around persistent local wallet state, enabling the agent to retain signing capability across sessions. In context, this persistence materially raises risk because a compromised agent environment, prompt abuse, or unauthorized reuse of the wallet can trigger future transactions without fresh wallet setup or strong re-authentication.
- Content
md # BSC PancakeSwap Trading Skill This skill lets the AI agent create a BSC wallet (private key + address saved in one file), **discover which tokens and swaps are available** on PancakeSwap, swap tokens, and receive top-ups from the user. The agent is not limited to specific tokens — it can resolve token addresses and check which pairs have liquidity. ## Configuration (BSC Mainnet)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill instructs creation of a wallet file containing an unencrypted private key and public metadata, which materially increases the chance of key theft through local compromise, backups, logs, or accidental disclosure. In this skill’s context, the key directly authorizes on-chain transfers and swaps, so exposure can lead to irreversible loss of funds.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trade execution section describes signing and broadcasting swaps without requiring a just-in-time user confirmation, transaction preview, or explicit risk acknowledgement at the execution step. Because blockchain transactions are irreversible and the skill is designed to handle arbitrary tokens and routes, mistakes or prompt-induced abuse could immediately convert or drain user-provided assets.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md ## 7. Security Notes - **wallet.json** contains the private key. Restrict access: `chmod 600 ~/.config/bsc_agent/wallet.json`. - Use this wallet only for the agent and only with amounts you accept to lose if the machine or file is compromised. - Prefer a dedicated BSC wallet; do not reuse a wallet that holds large funds elsewhere.
Scope Creep
Low
- Category
- Excessive Agency
- Confidence
- 70% confidence
- Finding
Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
- Content
md # BSC PancakeSwap Trading Skill This skill lets the AI agent create a BSC wallet (private key + address saved in one file), **discover which tokens and swaps are available** on PancakeSwap, swap tokens, and receive top-ups from the user. The agent is not limited to specific tokens — it can resolve token addresses and check which pairs have liquidity. ## Configuration (BSC Mainnet)