ClawHub
Back to skill

Security audit

impossible finance skills

Security checks for vulnerabilities and agentic risk

Overview

The skill is openly designed for BSC trading, but it asks an agent to store and use a spend-capable private key in a default plaintext wallet file for irreversible financial transactions.

Review this carefully before installing. Use only a fresh, low-balance wallet, prefer the encrypted keystore option or an external signer, pin dependencies, and require explicit confirmation with displayed token addresses, amounts, slippage, approvals, and transaction destination before any swap or ClawChain registration.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
skill.md:126
Finding

Private Key Stored Unencrypted in the Default Wallet File

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
skill.md:105
Finding

Dependency Installation Is Not Reproducibly Pinned

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
skill.md:205
Finding

Unquoted Configurable Wallet Path Is Used in Shell Commands

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (11)

Credential Access

High
Category
Privilege Escalation
Confidence
89% confidence
Finding

The skill explicitly declares read access to a plaintext wallet file containing a BSC private key and optional access to another credentials file. Even though this is core functionality, persistent local secret storage in plaintext substantially increases the blast radius if the agent, host, logs, backups, or adjacent tooling are compromised.

Content

Scanner excerpt · skill.md (reported line 37)May include surrounding context.

md
description: "Contains the agent's BSC private key and public address. Created once during wallet setup. The agent uses this to sign swap transactions on BSC. This file SHOULD be encrypted at rest — see Security section."
    access: read
  - name: ClawChain Credentials (optional)
    path: "~/.config/clawchain/credentials.json"
    description: "Chromia keypair used to authenticate on-chain operations. Only needed if registering the BSC public key on ClawChain for EVM event tracking. This file is created by the clawchain skill, not by this skill."
    access: read
    optional: true

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · skill.md (reported line 67)May include surrounding context.

md
- It does **not** manage ClawChain agent registration. For that, see the `clawchain` skill (`skill.md` or `curl_skills.md`).

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.md (reported line 69)May include surrounding context.

md
- It does **not** manage ClawChain agent registration. For that, see the `clawchain` skill (`skill.md` or `curl_skills.md`).
- It does **not** provide investment advice or execute trades without user confirmation.
- It does **not** access any files outside of `~/.config/impossible_agent/` and optionally `~/.config/clawchain/credentials.json` (read-only, for EVM key registration only).

### Transparency: Files Accessed

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.md (reported line 190)May include surrounding context.

md
- It does **not** manage ClawChain agent registration. For that, see the `clawchain` skill (`skill.md` or `curl_skills.md`).
- It does **not** provide investment advice or execute trades without user confirmation.
- It does **not** access any files outside of `~/.config/impossible_agent/` and optionally `~/.config/clawchain/credentials.json` (read-only, for EVM key registration only).

### Transparency: Files Accessed

Credential Access

High
Category
Privilege Escalation
Confidence
85% confidence
Finding

The transparency table confirms the skill reads and writes a wallet file containing a private key and can read another credential file. This is legitimate for trading/signing, but it still represents real credential exposure risk because the skill design depends on direct filesystem access to long-lived secrets.

Content

Scanner excerpt · skill.md (reported line 76)May include surrounding context.

md
| File | Access | Purpose |
|------|--------|---------|
| `~/.config/impossible_agent/wallet.json` | Read/Write (created once) | Stores the agent's BSC private key and address for signing transactions |
| `~/.config/clawchain/credentials.json` | Read-only (optional) | Used only if registering BSC public key on ClawChain for EVM event tracking |

### Transparency: Network Calls

Credential Access

High
Category
Privilege Escalation
Confidence
91% confidence
Finding

The example command passes a credential file directly to a CLI via --secret ~/.config/clawchain/credentials.json, normalizing direct filesystem use of long-lived authentication material. If command execution, shell history, process inspection, or surrounding tooling are compromised, this can lead to unauthorized ClawChain actions tied to the agent identity.

Content

Scanner excerpt · skill.md (reported line 219)May include surrounding context.

md
56 \
  "$ADDRESS" \
  --ft-auth \
  --secret ~/.config/clawchain/credentials.json \
  -brid $CLAWCHAIN_BRID \
  --api-url $CLAWCHAIN_NODE \
  --await

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skill.md (reported line 408)May include surrounding context.

md
| USDT | `0x55d398326f99059fF775485246999027B3197955` | Stablecoin |
| BUSD | `0xe9e7CEA3DedcA5984780Bafc599bD69ADd087D56` | Stablecoin |
| IF | `0xb0e1fc65c1a741b4662b813eb787d369b8614af1` | Impossible Finance governance token |
| IDIA | `0x0b15Ddf19D47E6a86A56148fb4aFFFc6929BcB89` | Impossible Decentralized Incubator Access token |

**Do not limit to these.** The agent should accept any BEP-20 address and discover availability via `getPair` / `getReserves` and `getAmountsOut` (see §3). If a pair has no liquidity, try a multi-hop path via WBNB or use the Impossible Finance UI.

Session Persistence

Medium
Category
Rogue Agent
Confidence
88% confidence
Finding

The skill instructs the agent to create and persist a reusable private key on disk for future signing operations. Long-lived session/key persistence increases the risk of account takeover and fund loss if the host or agent environment is later compromised, especially since the default format is plaintext JSON.

Content

Scanner excerpt · skill.md (reported line 116)May include surrounding context.

md
---

## 1. Wallet Setup — Create Wallet and Save Keys

The agent needs a local wallet file containing a **private key** and **public address** so it can sign transactions. This file is created once during initial setup and reused for all subsequent operations.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · skill.md (reported line 157)May include surrounding context.

}

text

- **privateKey** — Used to sign transactions. This file is restricted to owner-only access (`chmod 600`). Never log or expose this value.
- **address** — The agent's BSC account. The user sends BNB/tokens to this address to fund the agent.
- **publicKey** — Derived from private key. Used optionally for ClawChain EVM event tracking registration.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · skill.md (reported line 420)May include surrounding context.

}

text

- **privateKey** — Used to sign transactions. This file is restricted to owner-only access (`chmod 600`). Never log or expose this value.
- **address** — The agent's BSC account. The user sends BNB/tokens to this address to fund the agent.
- **publicKey** — Derived from private key. Used optionally for ClawChain EVM event tracking registration.

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · skill.md (reported line 421)May include surrounding context.

  • wallet.json must be restricted to owner-only access. The wallet creation script sets mode: 0o600 automatically. Verify with:
    bash
    chmod 600 ~/.config/impossible_agent/wallet.json
ls -la ~/.config/impossible_agent/wallet.json
# Should show: -rw-------

Static analysis

No suspicious patterns detected.