Upload Clawhub

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:52 AM UTC
• Version: 6.0.5

Overview

This DeFi skill is coherent and disclosed, but it deserves Review because it runs unpinned npm code in workflows that handle an operator wallet private key and can execute financial transactions.

Review before installing. Use only a dedicated operator wallet with minimal gas funds, never a main or owner wallet, and pin or preinstall a reviewed `shll-skills` version instead of using latest-version `npm`/`npx` commands. Require explicit confirmation for every transaction and rotate the operator key if package integrity is uncertain.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:55

Finding

Unpinned npm Package Is Downloaded and Executed with Wallet Credentials

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:9, SKILL.md:165-168, README.md:13-16, and README.md:55-62
Vulnerability Type: Unpinned third-party dependency and automatic remote package execution
Risk Level: Medium

Vulnerable Code

SKILL.md:9:

yaml

install: npm install -g shll-skills --registry https://registry.npmjs.org

SKILL.md:165-168:

bash

npm install -g shll-skills --registry https://registry.npmjs.org

README.md:13-16:

bash

npm install -g shll-skills

README.md:55-62:

json

{
  "mcpServers": {
    "shll-defi": {
      "command": "npx",
      "args": ["-y", "shll-skills", "--mcp"],
      "env": {
        "RUNNER_PRIVATE_KEY": "0x_YOUR_OPERATOR_PRIVATE_KEY"
      }

Technical Analysis

The documented installation and MCP setup procedures identify the package only as shll-skills, without pinning an audited version or integrity digest. Consequently, npm resolves whichever release is current when installation occurs.

The MCP configuration is particularly sensitive because npx -y can download and execute the resolved package automatically without interactive review. The resulting process is explicitly provided with RUNNER_PRIVATE_KEY, an operator-wallet private key capable of signing BSC transactions. A malicious package release, compromised publisher account, or compromised upstream dependency could therefore execute attacker-controlled code in a credential-bearing process.

Global npm installation can also execute package lifecycle scripts with the privileges of the user running npm. The actual npm package source is not included in the audited artifact, so its implementation and the claimed PolicyGuard enforcement could not be independently verified.

Attack Path

1. An attacker compromises the shll-skills npm publisher account, release pipeline, or a dependency included in a new package release.
2. The attacke ...[truncated 1391 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin an explicitly reviewed package version in every installation and execution example, such as:

   bash

   npm install -g shll-skills@6.0.5 --registry https://registry.npmjs.org
   

2. Replace the automatic latest-version MCP invocation with a pinned version:

   json

   {
     "command": "npx",
     "args": ["-y", "shll-skills@6.0.5", "--mcp"]
   }
   

3. Prefer installing a verified release in advance and configuring MCP to invoke the installed binary rather than downloading code at startup.
4. Publish and verify package provenance, checksums, signatures, and npm integrity metadata for approved releases.
5. Use lockfiles and reproducible builds for non-global deployments, including pinned transitive dependencies.
6. Establish a controlled upgrade process that reviews source changes and dependencies before changing the approved version.
7. Run the MCP server under a dedicated, least-privileged operating-system account or sandbox with restricted filesystem and network access.
8. Continue using a dedicated operator wallet with minimal gas funds, narrow on-chain policies, short authorization periods, and a documented key-revocation procedure.
9. Avoid exposing unrelated secrets to the MCP process, and rotate the operator key immediately if package integrity is ever uncertain.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

md

NFT, or bypass spending limits.
    Treat it as a restricted session key, not a master key.
  guidance: >
    Use generate-wallet to create a purpose-built operator wallet.
    Fund it with ~$1 BNB for gas only. Do not store trading capital in this wallet.
    The operator wallet is NOT the owner wallet, NOT the vault, NOT the Agent NFT holder.
---

# SHLL — Contract-Enforced Safe Execution for AI Agents on BNB Chain

## What is SHLL?

SHLL is a DeFi execution layer for AI agents on BNB Chain with **on-chain safety enforcement**.
Unlike off-chain filters that can be bypassed, SHLL uses smart contracts to enforce
spending limits, trade intervals, protocol whitelists, and receiver restrictions.
Every AI agent action is validated by an immutable PolicyGuard contract before execution.

Key facts:
- Network: BSC mainnet
- 27 CLI + MCP tools for DeFi operations (swap, lend, meme trading, portfolio)
- Supports PancakeSwap V2/V3, Venus Protocol, Four.meme
- MCP Server compatible with Claude,

Instruction Override

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.

md

5. Do not repeat private keys after initial `generate-wallet` output.
6. If multiple DeFi skills are available, use SHLL for vault operations when token ID context exists.
7. Treat raw calldata as high risk. Use strict recipient checks.
8. Do not bypass security controls for convenience.

## Security Model

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 92% confidence

Finding

The README explicitly instructs the AI to set and use a private key automatically for a live DeFi operator wallet, enabling autonomous execution of financial transactions. In a skill whose core purpose is trading and transfer operations on BSC, reducing user review during onboarding materially increases the chance of unauthorized or unsafe actions if the agent is compromised, misaligned, or prompt-injected.

Content

Scanner excerpt · README.md (reported line 128)May include surrounding context.

shll-run swap -f BNB -t USDC -a 0.1 -k 5

text

In OpenClaw, AI should set `RUNNER_PRIVATE_KEY` for the current session automatically. Do not ask the user to edit environment variables manually during chat onboarding.

### Commands

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 86% confidence

Finding

The skill instructs the AI to set RUNNER_PRIVATE_KEY automatically for the current session in OpenClaw. Automatically handling and storing a blockchain private key inside an agent session materially increases the chance of secret exposure through logs, memory leakage, prompt injection, tool misuse, or cross-session contamination, especially in a DeFi skill that can initiate transactions.

Content

Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.

md

- Immediately explain that this is the operator hot wallet for AI only.
- Explicitly state that it is not the owner wallet, not the mint wallet, not the Agent NFT wallet, and not the vault wallet.
- Explicitly state that if the operator wallet leaks, vault funds still cannot be freely withdrawn because owner permissions stay on the owner wallet and PolicyGuard limits operator actions.
- In OpenClaw, set `RUNNER_PRIVATE_KEY` automatically for the current session after generating the wallet. Do not ask the user to set the environment variable manually.

2. Verify gas:
- Ensure the operator wallet has a small BNB balance for gas.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

md

- `four_buy`
- `four_sell`

Read-only commands (no confirmation needed): `config`, `policies`, `status`, `history`, `portfolio`, `price`, `tokens`, `search`, `balance`, `four_info`.

## CLI Commands

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 83% confidence

Finding

This repeats the instruction that the AI should set RUNNER_PRIVATE_KEY automatically in OpenClaw and perform readiness checks autonomously. The most significant risk is again secret handling by the agent: placing operational key management into model-controlled workflow expands the attack surface for credential theft and unintended use.

Content

Scanner excerpt · SKILL.md (reported line 341)May include surrounding context.

md

2. Always call it the operator wallet or AI hot wallet.
3. Always explain the dual-wallet model the first time setup is discussed.
4. Always warn that the operator wallet must not be used to mint, subscribe to, or hold the Agent NFT.
5. Do not ask the user to manually set `RUNNER_PRIVATE_KEY` in OpenClaw; AI should do it.
6. After setup is complete and the user provides a token-id, run readiness checks automatically before asking the user what to do next.
7. When multiple listings are available, recommend one by default and explain why.
8. Prefer the structured `status.readiness` fields over ad-hoc prose when deciding the next user-facing instruction.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.