ClawHub
Back to skill

Security audit

Arc402 Agent

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent for an ARC-402 payment agent, but it gives an agent high-impact authority over live blockchain funds, a daemon, credentials, persistent memory, and a public relay that need careful review before use.

Install only if you intend to run an autonomous payment agent. Use a dedicated low-balance wallet, strict spend limits, separate credentials, and explicit human approval rules for hires, accepts, releases, disputes, endpoint registration, and any freeze/drain action. Prefer MCP over public HTTP; if HTTP relay mode is needed, put it behind TLS, authentication or signed request verification, firewall or allowlist rules, replay protection, and rate limiting. Verify the arc402-cli package, source repository, audit claims, and memory retention controls independently before using live funds.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The skill first recommends avoiding inbound HTTP exposure for task delivery, then later documents and operationalizes a public HTTP relay on port 4402 with multiple POST endpoints and tunnel exposure. This inconsistency can cause operators to deploy an internet-reachable control surface despite believing the design avoids that class of attack, increasing risk of unsolicited requests, endpoint abuse, and prompt-injection delivery through network-facing handlers.

Static analysis

No suspicious patterns detected.