ClawHub
Back to skill

Security audit

Monero Profitability Calculator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a simple Monero profitability guide with a sample calculator; it has minor accuracy and disclosure issues but no hidden or high-impact behavior.

Before installing, treat this as a lightweight educational guide rather than a complete calculator. If you run or adapt the sample Python, expect it to contact CoinGecko for current price data, and verify the profitability formula because it uses a simplified fixed mining estimate rather than live network difficulty and block reward.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The surrounding documentation states the calculator estimates profitability using market factors including network difficulty and block reward, and even exposes them as inputs in the documented interface. However, the code sample's calculate_profitability function accepts only hashrate, power, and cost, then hard-codes earnings as a flat 0.00015 XMR per 1000 H/s per day, which contradicts the stated basis of calculation rather than merely omitting an implementation detail.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

The sample Python code makes a live request to https://api.coingecko.com/api/v3/coins/monero, creating external data transmission to a third party. In this skill's context, the request appears related to fetching market price data rather than exfiltration, but it still introduces dependency on an external endpoint and potential privacy, reliability, and supply-trust concerns.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

md
def calculate_profitability(hashrate=2000, power=100, cost=0.12):
    # Fetch current XMR data
    xmr_data = requests.get('https://api.coingecko.com/api/v3/coins/monero').json()
    price = xmr_data['market_data']['current_price']['usd']
    
    # Estimate earnings (simplified)

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The markdown includes example code that performs an outbound request to a third-party API without explicitly warning users that running it will contact an external service. While the transmitted data is minimal here, undocumented network access can surprise users, create privacy concerns, and violate offline or restricted-environment expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.