ClawHub
Back to skill

Security audit

Crypto News Feed

Security checks for vulnerabilities and agentic risk

Overview

This skill is a low-risk static reference helper, though its crypto-specific content is mostly generic and may be less useful than advertised.

Install only if you want a simple static reference helper. Do not rely on it for current crypto news, legal compliance, or investment decisions because it does not fetch live data and its reference material is generic.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The description says this is a "Reference tool for blockchain and crypto" and a "Quick lookup" for concepts, best practices, and implementations, but it does not clearly specify how or when the skill should be invoked beyond a general topic area. This broad phrasing can overlap with many ordinary crypto-related user requests and may cause unintended activation because there are no scope boundaries or exclusion examples.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest and header claim this skill is a reference tool for blockchain and crypto concepts, including intro, formulas, regulations, and best practices. However, the command outputs are largely boilerplate text with generic business/risk/compliance language and almost no concrete crypto-news-specific or blockchain-specific reference material, indicating the implemented behavior does not substantively match the claimed subject matter.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The file header explicitly states this is a crypto news feed reference tool for blockchain contexts. The actual command implementations only emit broad, template-like reference material such as generic ratios, compliance bullets, and inspection checklists, which contradicts the specific intent conveyed by the documentation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.