ClawHub
Back to skill

Security audit

pancake skills

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed PancakeSwap trading guide, but it asks for persistent private-key handling and includes inconsistent optional ClawChain credential use that users should review carefully.

Install only if you are comfortable giving the agent a dedicated, low-balance BSC wallet and reviewing every swap before signing. Avoid using the optional ClawChain registration path unless you explicitly want that identity binding, and prefer an encrypted keystore or external signer over the default plaintext wallet file.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
skill.md:125
Finding

Private key stored in plaintext wallet file

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
skill.md:40
Finding

Unpinned third-party dependency creates mutable supply-chain exposure

Content
View full analysis
=18" description: "JavaScript runtime required to run ethers.js wallet and transaction scripts." - name: ethers version: "6" description: "Ethereum library for wallet generation, contract interaction, and transaction signing." install: "npm install ethers" ``` The prerequisite instructions repeat the floating installation: ```bash npm install ethers # or: pnpm add ethers ``` ### Technical Analysis The installation command resolves the package and its transitive dependencies from the package registry at installation time. It does not identify an exact reviewed release or require a committed lockfile with expected integrity hashes. Consequently, the code installed in the future can differ from the code considered during this audit. A compromised package publisher, malicious future release, compromised transitive dependency, or registry-level incident could introduce code that executes during installation or when the Skill imports `ethers`. This exposure is particularly significant because the dependency runs in the same Node.js process that reads the plaintext wallet private key and signs financial transactions. The package name itself is consistent with the legitimate ethers library; the audit found no evidence of typosquatting or an intentionally malicious source. The risk arises from mutable and insufficiently constrained dependency resolution. ### Attack Path 1. An attacker compromises a future `ethers` release, one of its transitive dependencies, or the associated registry publishing channel. 2. The user follows the documented `npm install e ...[truncated 1385 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

The skill declares access to a ClawChain credentials file unrelated to core PancakeSwap trading, expanding the credential boundary into another system. Even read-only access to authentication material is sensitive because the later instructions use it to authenticate on-chain operations, enabling unintended cross-system actions if the skill is over-permissioned or compromised.

Content

Scanner excerpt · skill.md (reported line 33)May include surrounding context.

md
description: "Contains the agent's BSC private key (encrypted or plaintext) and public address. Created once during wallet setup. The agent uses this to sign swap transactions on BSC. This file SHOULD be encrypted at rest — see Security section."
    access: read
  - name: ClawChain Credentials (optional)
    path: "~/.config/clawchain/credentials.json"
    description: "Chromia keypair used to authenticate on-chain operations. Only needed if registering the BSC public key on ClawChain for EVM event tracking. This file is created by the clawchain skill, not by this skill."
    access: read
    optional: true

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · skill.md (reported line 61)May include surrounding context.

md
- It does **not** manage ClawChain agent registration. For that, see the `clawchain` skill (`skill.md` or `curl_skills.md`).

Credential Access

High
Category
Privilege Escalation
Confidence
89% confidence
Finding

The skill claims optional access to ~/.config/clawchain/credentials.json, which grants visibility into another skill's authentication material and broadens the attack surface beyond BSC trading. In context, this is more dangerous because the same file later enables authenticated registration actions on ClawChain, not merely passive reads.

Content

Scanner excerpt · skill.md (reported line 63)May include surrounding context.

md
- It does **not** manage ClawChain agent registration. For that, see the `clawchain` skill (`skill.md` or `curl_skills.md`).
- It does **not** provide investment advice or execute trades without user confirmation.
- It does **not** access any files outside of `~/.config/bsc_agent/` and optionally `~/.config/clawchain/credentials.json` (read-only, for EVM key registration only).

### Transparency: Files Accessed

Credential Access

High
Category
Privilege Escalation
Confidence
89% confidence
Finding

Documenting and permitting read-only access to ClawChain credentials still represents credential exposure because the skill can consume secrets from an unrelated trust domain. Since the skill's primary purpose is token trading, this extra credential path is unnecessary for most use cases and increases the consequences of misuse or prompt injection.

Content

Scanner excerpt · skill.md (reported line 70)May include surrounding context.

md
| File | Access | Purpose |
|------|--------|---------|
| `~/.config/bsc_agent/wallet.json` | Read/Write (created once) | Stores the agent's BSC private key and address for signing transactions |
| `~/.config/clawchain/credentials.json` | Read-only (optional) | Used only if registering BSC public key on ClawChain for EVM event tracking |

### Transparency: Network Calls

Credential Access

High
Category
Privilege Escalation
Confidence
91% confidence
Finding

This section operationalizes use of the ClawChain credentials file as a prerequisite for authenticated actions, confirming that the skill is not merely documenting optional compatibility but actively depending on external secrets. Cross-system credential reuse increases the blast radius if the skill behaves unexpectedly or is socially engineered into performing unauthorized operations.

Content

Scanner excerpt · skill.md (reported line 194)May include surrounding context.

md
- A registered agent account on ClawChain (Chromia)
- An authenticated session (FT4 keypair from ClawChain registration)
- Your `wallet.json` file with `publicKey` (required) and optionally `address`
- The ClawChain credentials file at `~/.config/clawchain/credentials.json` (created by the `clawchain` skill)

### Environment Variables for ClawChain

Credential Access

High
Category
Privilege Escalation
Confidence
94% confidence
Finding

The command passes --secret ~/.config/clawchain/credentials.json to perform authenticated ClawChain registration, demonstrating active use of sensitive credentials from another subsystem. This is dangerous because a PancakeSwap skill can now trigger privileged identity-binding operations outside its advertised core purpose, magnifying harm from misuse or unauthorized invocation.

Content

Scanner excerpt · skill.md (reported line 223)May include surrounding context.

md
56 \
  "$ADDRESS" \
  --ft-auth \
  --secret ~/.config/clawchain/credentials.json \
  -brid $CLAWCHAIN_BRID \
  --api-url $CLAWCHAIN_NODE \
  --await

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The metadata and top-level description understate the skill's actual capabilities by omitting ClawChain/Chromia registration and querying behavior, while later sections instruct the agent to access external credentials and perform those operations. This kind of scope mismatch can bypass user expectations and policy gating, making sensitive cross-system actions more likely to occur without informed consent.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The document explicitly states it does not manage ClawChain agent registration, but later provides step-by-step registration and query commands using ClawChain credentials. This contradiction creates deceptive scope boundaries and can cause an agent or operator to authorize actions they believed were excluded.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
88% confidence
Finding

The skill instructs the agent to create and persist a long-lived local wallet containing private key material for future reuse. Persistent session/key state is risky because compromise of the host, file, logs, or adjacent skills can lead to durable unauthorized transaction signing and fund loss.

Content

Scanner excerpt · skill.md (reported line 120)May include surrounding context.

md
---

## 1. Wallet Setup — Create Wallet and Save Keys

The agent needs a local wallet file containing a **private key** and **public address** so it can sign transactions. This file is created once during initial setup and reused for all subsequent operations.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · skill.md (reported line 161)May include surrounding context.

}

text

- **privateKey** — Used to sign transactions. This file is restricted to owner-only access (`chmod 600`). Never log or expose this value.
- **address** — The agent's BSC account. The user sends BNB/tokens to this address to fund the agent.
- **publicKey** — Derived from private key. Used optionally for ClawChain EVM event tracking registration.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · skill.md (reported line 420)May include surrounding context.

}

text

- **privateKey** — Used to sign transactions. This file is restricted to owner-only access (`chmod 600`). Never log or expose this value.
- **address** — The agent's BSC account. The user sends BNB/tokens to this address to fund the agent.
- **publicKey** — Derived from private key. Used optionally for ClawChain EVM event tracking registration.

File System Enumeration

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · skill.md (reported line 421)May include surrounding context.

  • wallet.json must be restricted to owner-only access. The wallet creation script sets mode: 0o600 automatically. Verify with:
    bash
    chmod 600 ~/.config/bsc_agent/wallet.json
ls -la ~/.config/bsc_agent/wallet.json
# Should show: -rw-------

Static analysis

No suspicious patterns detected.