ClawHub
Back to skill

Security audit

Minara Skill V2

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real Minara crypto trading skill, but it needs careful review because it installs a mutable global CLI and can control high-impact wallet, payment, and automated trading actions.

Install only if you trust Minara and are comfortable giving an agent access to a logged-in crypto wallet/trading CLI. Prefer a pinned, reviewed CLI version in a dedicated environment, keep API keys narrowly scoped, verify recipients and trade parameters independently, and do not enable autopilot or skip confirmations unless you intentionally accept the financial risk.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:5
Finding

Unpinned Global npm Dependency Creates Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:5
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Complete Code Snippet:

yaml
metadata:
  { "openclaw": { "always": false, "primaryEnv": "MINARA_API_KEY", "requires": { "bins": ["minara"], "config": ["skills.entries.minara.enabled"] }, "emoji": "👩", "homepage": "https://minara.ai", "install": [{ "id": "node", "kind": "node", "package": "minara@latest", "global": true, "bins": ["minara"], "label": "Install Minara CLI (npm)" }] } }

Technical Analysis

The Skill installs minara@latest globally. The mutable latest tag does not identify an immutable, previously audited package version. Consequently, the code installed in the future may differ from the code that was present when this Skill was reviewed.

npm packages can execute lifecycle scripts during installation and arbitrary code when invoked. Global installation also makes the resulting executable broadly available in the user's environment. This is particularly sensitive because the CLI handles wallet operations, authenticates through MINARA_API_KEY or ~/.minara/credentials.json, and can initiate fund-moving transactions.

The audit did not establish that the current minara package is malicious. The vulnerability is the unsafe dependency policy and the resulting exposure to a future compromised, hijacked, or defective release.

Attack Path

  1. An attacker compromises the npm publisher account, package release process, or another component of the package's distribution chain.
  2. The attacker publishes a malicious version under the minara package and assigns it to the latest tag.
  3. A user installs or reinstalls the Skill dependency.
  4. The installer resolves minara@latest to the attacker-controlled release and installs it globally.
  5. Malicious lifecycle or runtime code executes with the installing user's privileges.
  6. The compromised CLI ...[truncated 1004 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace minara@latest with an exact, reviewed version, such as minara@2.4.12 where that version has been independently verified.
  2. Enforce package integrity using a lockfile, verified registry integrity metadata, or a pinned artifact digest.
  3. Establish a controlled update process that reviews source changes and package lifecycle scripts before changing the pinned version.
  4. Avoid global installation where practical. Install the CLI in a dedicated, least-privileged environment with constrained filesystem and environment-variable access.
  5. Disable npm lifecycle scripts during installation unless they are documented, audited, and required.
  6. Verify package provenance and publisher identity through trusted registry provenance or signed releases.
  7. Ensure transaction confirmation presents authoritative transaction details through a trusted channel independent of mutable CLI output.
  8. Restrict credential-file permissions and expose MINARA_API_KEY only to the specific process that requires it.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (16)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md
**Routing gate (anti-collision):** apply this skill only when the message includes a **finance/trading action** *and* at least one **crypto/chain/Minara signal** (token, chain, DeFi term, or "Minara"). If missing crypto context, do not route here.

Requires logged-in CLI: check `~/.minara/credentials.json`; if missing → `minara login` (prefer device code). If device login prints a verification URL/code, relay it to the user and wait for completion (do not claim login is impossible). If `MINARA_API_KEY` is set, CLI authenticates automatically.

## Transaction confirmation (CRITICAL)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.

md
**Routing gate (anti-collision):** apply this skill only when the message includes a **finance/trading action** *and* at least one **crypto/chain/Minara signal** (token, chain, DeFi term, or "Minara"). If missing crypto context, do not route here.

Requires logged-in CLI: check `~/.minara/credentials.json`; if missing → `minara login` (prefer device code). If device login prints a verification URL/code, relay it to the user and wait for completion (do not claim login is impossible). If `MINARA_API_KEY` is set, CLI authenticates automatically.

## Transaction confirmation (CRITICAL)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md
For any fund-moving command (`swap`, `transfer`, `withdraw`, `perps order`, `perps deposit`, `perps withdraw`, `limit-order create`, `deposit buy`):

1. **Before executing:** show the user a summary of what will happen (action, token, amount, recipient/chain) and **ask for explicit confirmation**. Do NOT auto-confirm.
2. **After the CLI returns a confirmation prompt** (e.g. "Are you sure you want to proceed?"): relay the details back to the user and **wait for the user to approve** before answering `y`. Never answer `y` on the user's behalf without their consent.
3. **`-y` / `--yes` policy:** never add `-y` (or any auto-confirm flag) unless the user explicitly asks to skip confirmation.
4. **If the user declines:** abort the operation immediately.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
For any fund-moving command (`swap`, `transfer`, `withdraw`, `perps order`, `perps deposit`, `perps withdraw`, `limit-order create`, `deposit buy`):

1. **Before executing:** show the user a summary of what will happen (action, token, amount, recipient/chain) and **ask for explicit confirmation**. Do NOT auto-confirm.
2. **After the CLI returns a confirmation prompt** (e.g. "Are you sure you want to proceed?"): relay the details back to the user and **wait for the user to approve** before answering `y`. Never answer `y` on the user's behalf without their consent.
3. **`-y` / `--yes` policy:** never add `-y` (or any auto-confirm flag) unless the user explicitly asks to skip confirmation.
4. **If the user declines:** abort the operation immediately.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.

md
For any fund-moving command (`swap`, `transfer`, `withdraw`, `perps order`, `perps deposit`, `perps withdraw`, `limit-order create`, `deposit buy`):

1. **Before executing:** show the user a summary of what will happen (action, token, amount, recipient/chain) and **ask for explicit confirmation**. Do NOT auto-confirm.
2. **After the CLI returns a confirmation prompt** (e.g. "Are you sure you want to proceed?"): relay the details back to the user and **wait for the user to approve** before answering `y`. Never answer `y` on the user's behalf without their consent.
3. **`-y` / `--yes` policy:** never add `-y` (or any auto-confirm flag) unless the user explicitly asks to skip confirmation.
4. **If the user declines:** abort the operation immediately.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
1. **Before executing:** show the user a summary of what will happen (action, token, amount, recipient/chain) and **ask for explicit confirmation**. Do NOT auto-confirm.
2. **After the CLI returns a confirmation prompt** (e.g. "Are you sure you want to proceed?"): relay the details back to the user and **wait for the user to approve** before answering `y`. Never answer `y` on the user's behalf without their consent.
3. **`-y` / `--yes` policy:** never add `-y` (or any auto-confirm flag) unless the user explicitly asks to skip confirmation.
4. **If the user declines:** abort the operation immediately.

This applies to all operations that move funds. Read-only commands (`balance`, `assets`, `chat`, `discover`, etc.) do not require confirmation.

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md
Chain is **auto-detected** from the token. If a token exists on multiple chains, the CLI prompts the user to pick one (sorted by gas cost). Sell mode supports `-a all` to sell entire balance.

| User intent pattern                                                                                                                                      | Action                                                                 |
| -------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- |
| "swap 0.1 ETH to USDC", "buy me 100 USDC worth of ETH", "sell 50 SOL for USDC", "convert 200 USDC to BONK on Solana" — natural-language or explicit swap | Extract params → `minara swap -s <buy\|sell> -t '<token>' -a <amount>` |
| "sell all my BONK", "dump entire SOL position"                                                                                                           | `minara swap -s sell -t '<token>' -a all`                              |

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md
| User intent pattern                                                                                                                                      | Action                                                                 |
| -------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- |
| "swap 0.1 ETH to USDC", "buy me 100 USDC worth of ETH", "sell 50 SOL for USDC", "convert 200 USDC to BONK on Solana" — natural-language or explicit swap | Extract params → `minara swap -s <buy\|sell> -t '<token>' -a <amount>` |
| "sell all my BONK", "dump entire SOL position"                                                                                                           | `minara swap -s sell -t '<token>' -a all`                              |
| Simulate a crypto swap without executing                                                                                                                 | `minara swap -s <side> -t '<token>' -a <amount> --dry-run`             |

### Transfer / send / pay / withdraw crypto

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md
| -------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------- |
| "swap 0.1 ETH to USDC", "buy me 100 USDC worth of ETH", "sell 50 SOL for USDC", "convert 200 USDC to BONK on Solana" — natural-language or explicit swap | Extract params → `minara swap -s <buy\|sell> -t '<token>' -a <amount>` |
| "sell all my BONK", "dump entire SOL position"                                                                                                           | `minara swap -s sell -t '<token>' -a all`                              |
| Simulate a crypto swap without executing                                                                                                                 | `minara swap -s <side> -t '<token>' -a <amount> --dry-run`             |

### Transfer / send / pay / withdraw crypto

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md
Triggers: message mentions sending, transferring, paying, or withdrawing a crypto token to a wallet address (0x… or base58).

| User intent pattern                                                                                                                   | Action                                                                                                  |
| ------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- |
| "send 10 SOL to 0x…", "transfer USDC to <address>" — crypto token + recipient address                                                 | `minara transfer` (interactive) or extract params                                                       |
| "pay 100 USDC to 0x…", "pay <address> 50 USDC" — payment to address (equivalent to transfer)            | `minara transfer` (interactive) or extract params                                                       |

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md
Triggers: message mentions sending, transferring, paying, or withdrawing a crypto token to a wallet address (0x… or base58).

| User intent pattern                                                                                                                   | Action                                                                                                  |
| ------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- |
| "send 10 SOL to 0x…", "transfer USDC to <address>" — crypto token + recipient address                                                 | `minara transfer` (interactive) or extract params                                                       |
| "pay 100 USDC to 0x…", "pay <address> 50 USDC" — payment to address (equivalent to transfer)            | `minara transfer` (interactive) or extract params                                                       |

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

md
Triggers: message mentions sending, transferring, paying, or withdrawing a crypto token to a wallet address (0x… or base58).

| User intent pattern                                                                                                                   | Action                                                                                                  |
| ------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------- |
| "send 10 SOL to 0x…", "transfer USDC to <address>" — crypto token + recipient address                                                 | `minara transfer` (interactive) or extract params                                                       |
| "pay 100 USDC to 0x…", "pay <address> 50 USDC" — payment to address (equivalent to transfer)            | `minara transfer` (interactive) or extract params                                                       |

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 112)May include surrounding context.

md
> **Timeout:** AI chat responses can be long-running. Set shell execution timeout to **15 minutes** (900 s) for all `minara chat` commands.

| User intent pattern                                                                                                                  | Action                                 |
| ------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------- |
| "what's the BTC price", "analyze ETH tokenomics", "DeFi yield opportunities", crypto research, on-chain analysis                     | `minara chat "<user text>"`            |
| "analyze this Polymarket event", "prediction market odds on <topic>", "what are the chances of <event>" — prediction market insights | `minara chat "<user text or URL>"`     |

Whitespace Padding

Medium
Category
Prompt Injection
Confidence
70% confidence
Finding

Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

md
| Deep crypto analysis requiring reasoning — "think through ETH vs SOL long-term"                                                      | `minara chat --thinking "<user text>"` |
| High-quality detailed crypto analysis — "detailed report on Solana DeFi ecosystem"                                                   | `minara chat --quality "<user text>"`  |
| "continue our previous Minara chat"                                                                                                  | `minara chat -c <chatId>`              |
| "list my Minara chat history"                                                                                                        | `minara chat --list`                   |

### Crypto & stock market discovery

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

These examples include real fund-moving and trading operations such as transfers, withdrawals, deposits, and perps funding without adjacent warnings to require explicit user confirmation or to emphasize irreversible financial consequences. In an agent setting, example commands often become executable playbooks, so omission of safety guidance increases the risk of accidental or socially induced loss of funds.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The 'autopilot' feature is presented as a simple example despite implying automated trading strategy execution that can place trades and materially affect user funds. Without a prominent warning and consent requirements, an agent or user may treat it as harmless analysis rather than an action-capable financial automation feature.

Content

No source excerpt is available for this finding.