ClawHub
Back to skill

Security audit

Signal Intelligence

Security checks for vulnerabilities and agentic risk

Overview

This skill is a paid crypto-signal lookup that is disclosed, but it asks the agent to use a raw EVM private key for automatic paid requests without clear user confirmation or spending limits.

Review carefully before installing. Use only a dedicated low-balance wallet, assume each invocation can spend USDC on Base mainnet, avoid automatic or repeated agent calls, and do not provide a primary wallet private key unless the skill adds explicit confirmation and spending controls.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:6
Finding

Unrestricted Automated Payments Using a Raw EVM Private Key

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 6–9, 25–35, and 46
Vulnerability Type: Raw private-key exposure to a payment-capable client without documented spending controls
Risk Level: High

Vulnerable Code

yaml
metadata:
  openclaw:
    requires:
      env:
        - EVM_PRIVATE_KEY
    primaryEnv: EVM_PRIVATE_KEY
markdown
The agent makes an x402-authenticated GET request to:

https://apexrunner.ai/signals/signal-intelligence

text

The x402 client handles payment authorisation automatically. No API key, no account, no subscription required — just an EVM wallet with USDC on Base mainnet.

```python
# Example using the x402-python client
from x402.client import x402_get

response = x402_get(
    url="https://apexrunner.ai/signals/signal-intelligence",
    private_key=os.environ["EVM_PRIVATE_KEY"]
)
print(response.json())
text

```markdown
**$0.25/call** — standard price

Technical Analysis

The skill requires access to a reusable EVM private key and passes that key directly to x402_get, a third-party client capable of signing payment authorizations. The documentation explicitly states that payment authorization occurs automatically.

Although the documented service price is $0.25/call, the skill does not demonstrate client-side enforcement of that amount. It also provides no explicit per-payment confirmation, maximum transaction amount, cumulative spending budget, request-count limit, recipient allowlist, chain validation, token restriction, or isolated-wallet requirement.

Consequently, the signing authority available to the skill is broader than necessary for retrieving one signal. The private key potentially controls every asset and permission associated with the configured wallet, while the intended task only requires narrowly scoped payment authorization. There is no evidence in the reviewed file that the key is deliberately exfi ...[truncated 1507 chars]

Remediation
View remediation

Remediation Suggestions

  1. Use a dedicated, low-balance payment wallet rather than a primary wallet or a key controlling unrelated assets.
  2. Prefer a scoped session key, delegated authorization, or smart-account policy that can only pay the intended recipient, token, network, and maximum amount.
  3. Validate the x402 payment challenge before signing, including:
    • Expected Base mainnet chain identifier
    • USDC token contract
    • Approved recipient
    • Maximum charge per request
    • Challenge expiration and nonce
  4. Enforce a client-side cumulative spending budget and request-count limit that cannot be overridden by remote response data.
  5. Require explicit user confirmation before each payment, showing the recipient, token, amount, network, and remaining budget.
  6. Prevent uncontrolled retries and agent loops by making paid calls non-retriable by default or by applying a strict retry ceiling.
  7. Pin the x402 client to a reviewed version, verify package integrity, and audit its key-handling and payment-validation behavior.
  8. Ensure the private key is never logged, serialized, included in errors, exposed to unrelated tools, or retained after execution.
  9. Document wallet isolation and maximum funding requirements directly in the skill instructions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly instructs the agent to make an x402-authenticated request using an EVM private key, and the pricing section states that each call costs money. However, the usage instructions do not prominently warn that invoking the skill authorizes a paid transaction and may spend USDC from the user's wallet, which can lead to unintended fund loss through routine agent execution or repeated calls.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.