ClawHub
Back to skill

Security audit

Spacescan

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent read-only Spacescan blockchain lookup skill, but users should update dependencies and handle the API key carefully.

Install only if you are comfortable sending queried Chia addresses, transaction IDs, hashes, and searches to Spacescan. Use a limited Spacescan API key, avoid committing shell profiles or dotfiles containing the key, and update/pin the npm dependencies before relying on the skill in a sensitive environment.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (7)

Known Vulnerable Dependency: axios==1.13.4 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High
Category
Supply Chain
Confidence
93% confidence
Finding
The lockfile pins axios 1.13.4, and the supplied advisories indicate multiple known security issues affecting this version, including SSRF-related proxy bypass and prototype-pollution-enabled request/response compromise scenarios. Because this skill appears to be a network-oriented scanner and explicitly depends on axios, vulnerable HTTP client behavior is directly relevant and increases the likelihood that these issues could be reached in real use.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High
Category
Supply Chain
Confidence
80% confidence
Finding
form-data 4.0.5 is reported vulnerable to CRLF injection through unescaped multipart field names and filenames. If the skill ever constructs multipart requests using untrusted input, an attacker could manipulate request bodies or headers, potentially smuggling data or altering upstream request interpretation.

Known Vulnerable Dependency: axios==1.13.4 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High
Category
Supply Chain
Confidence
80% confidence
Finding
The skill depends on axios through a broad semver range, and the static analysis indicates resolution to axios 1.13.4, which is reported as carrying multiple known advisories including SSRF-related and request-handling issues. In a blockchain explorer skill that likely performs outbound HTTP requests to third-party APIs, flaws in the HTTP client can materially increase risk of request manipulation, proxy bypass, credential leakage, or man-in-the-middle style exploitation depending on how the library is used.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The README tells users to append an API key directly into their shell profile, which can cause long-lived credential exposure through dotfile backups, screen sharing, shared accounts, or accidental publication of shell configs. While common, documenting persistent plaintext secrets without any warning or safer alternative increases the chance users mishandle credentials.

Missing User Warnings

Low
Confidence
84% confidence
Finding
Multiple command handlers invoke external API methods such as getLatestBlock, getBlock, getTransaction, search, and related calls, but this file provides no confirmation prompt, user-facing notice, or inline warning that user-supplied identifiers and queries will be sent to the Spacescan service. Because these commands transmit user input over the network, the absence of any disclosure is a safety transparency gap under the code-file warning criterion.

Known Vulnerable Dependency: follow-redirects==1.15.11 — 1 advisory(ies): CVE-2026-40895 (follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta)

Low
Category
Supply Chain
Confidence
82% confidence
Finding
follow-redirects 1.15.11 is flagged for leaking custom authentication headers across cross-domain redirects. Since axios depends on this package and a scanning skill is likely to make outbound HTTP requests, mishandled redirects could expose tokens or credentials to unintended hosts if authenticated requests are ever used.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"author": "Jeff Coleman",
  "license": "MIT",
  "dependencies": {
    "axios": "^1.6.0"
  },
  "engines": {
    "node": ">=18.0.0"
Confidence
95% confidence
Finding
The dependency is specified with a caret range ("^1.6.0"), which allows installation of newer 1.x releases without explicit review or lockstep control. This increases supply-chain risk because future installs may pull different code, including versions with security regressions or newly introduced malicious compromise, especially for a network-facing HTTP client like axios.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
lib/api.js:7