ClawHub
Back to skill

Security audit

Exchange Copy Trading

Security checks for vulnerabilities and agentic risk

Overview

The skill is a Markdown-only browser guide for exchange copy trading, but it should be reviewed carefully because it can automate a real financial follow-trader action using a hardcoded strategy URL and loose URL validation.

Only use this skill if you independently verify the exchange domain and trader or strategy before any automation starts. Do not rely on the packaged default URL as a recommendation, and keep the final transaction confirmation, legal acknowledgements, and risk acceptance under your direct control.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:30
Finding
Generic copy-trading requests are routed to a hardcoded trader## Vulnerability Details **File Location**: `SKILL.md`, lines 30–40 **Vulnerability Type**: Hardcoded financial transaction destination **Risk Level**: Medium ### Complete Affected Code Segment The following is an English rendering of the complete affected segment: ```markdown ## Bitget: Futures Copy Trading (Currently Supported) ### Target link (example trader/strategy page supplied by the business) `https://www.bitget.fit/zh-CN/copy-trading/setting/bfb7477187b73155a395/futures` > To change the trader or strategy, replace the corresponding ID in the path > or replace the complete URL. The package defaults to the example above. > The user must confirm that the link comes from a trusted source. ### Procedure (OpenClaw) 1. Open the browser and navigate to the URL above; wait for the main content to load. 2. Locate the copy amount or investment amount input. 3. Clear the input and enter the amount specified by the user. 4. Locate and click the Follow, Confirm Follow, or Follow Now primary button. ``` ### Technical Analysis The Skill is advertised for broad copy-trading requests, but its default procedure contains a fixed trader identifier, `bfb7477187b73155a395`. It directs the agent to open that trader's page and progress through controls capable of creating a futures copy-trading position. Although the surrounding instructions state that the user should confirm the URL, the Skill itself introduces the destination. It does not require the user to supply the trader identifier independently, verify the trader's identity, review the selected strategy, or provide transaction-specific confirmation immediately before the final submission. This creates an unsafe steering condition in which a generic request can be converted into a transaction benefiting or following an unidentified third party. ### Attack Path 1. A user makes a generic request for assistance with Bitget copy trading without naming a trader. 2. ...[truncated 909 chars]
Remediation
## Remediation Suggestions - Remove the fixed trader identifier and trader-specific URL from the default workflow. - Require the trader or strategy URL to be supplied explicitly by the user or selected manually through a verified official exchange interface. - Before entering an amount, display the normalized hostname, trader identity, strategy name, market type, leverage information, and relevant risk indicators. - Require explicit confirmation that names the trader, strategy, amount, and transaction type. - Add a mandatory pause immediately before the final submission button; do not treat a general copy-trading request as authorization for a specific financial transaction. - Keep legal agreements, risk acknowledgements, and any materially changed terms under direct user control. - Consider limiting automation to navigation and form preparation while requiring the user to perform the final transaction-confirming click.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:19
Finding
Insufficient validation of exchange URLs in an authenticated financial session## Vulnerability Details **File Location**: `SKILL.md`, line 19; related instructions at `SKILL.md`, line 33 and `reference.md`, line 11 **Vulnerability Type**: Ambiguous destination validation and phishing exposure **Risk Level**: Medium ### Complete Affected Code Segments The following are English renderings of the complete affected instructions: ```markdown - Do not impersonate an official service: only open links confirmed by the user. If the domain or page differs from the official service, stop and ask the user to verify it because of phishing risk. ``` ```markdown > To change the trader or strategy, replace the corresponding ID in the path > or replace the complete URL. The package defaults to the example above. > The user must confirm that the link comes from a trusted source. ``` ```markdown **Domain note**: Use the domain supplied by the user or by an official source. Skills published to ClawHub do not guarantee that links remain valid. Update the procedure in SKILL.md when the page changes. ``` ### Technical Analysis The Skill recognizes phishing as a risk but does not define an enforceable validation mechanism. It permits a complete user-provided URL and treats user confirmation as a sufficient trust signal. It does not specify: - An exact allowlist of verified exchange hostnames. - Mandatory HTTPS validation. - Rejection of embedded credentials, IP-address hosts, alternate ports, or deceptive subdomains. - Internationalized-domain and lookalike-domain checks. - Validation of every redirect in the navigation chain. - A prohibition on continuing when a destination requests login credentials, two-factor authentication codes, wallet signatures, API keys, or recovery secrets. User confirmation does not authenticate a domain. This is particularly significant because the workflow is intended to run in a browser containing an existing authenticated financial session. ### Attack Path ...[truncated 1134 chars]
Remediation
## Remediation Suggestions - Define and maintain an explicit allowlist of verified exchange hostnames obtained from authoritative sources. - Require HTTPS and exact normalized hostname matching; do not use substring or suffix-only checks. - Reject raw IP addresses, nonstandard ports, embedded URL credentials, malformed URLs, deceptive subdomains, and internationalized lookalike domains. - Validate the initial destination and every redirect before allowing browser interaction to continue. - Display the normalized destination hostname to the user before navigation. - Stop immediately if the page requests passwords, two-factor authentication codes, API credentials, seed phrases, private keys, recovery codes, or wallet signatures not explicitly required and independently verified. - Do not treat user confirmation alone as proof that a destination is official. - Use exchange-owned navigation from a verified homepage where practical rather than accepting arbitrary deep links. - Require manual user intervention when the hostname, certificate state, redirect chain, or page identity cannot be validated reliably.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.