ClawHub
Back to skill

Security audit

web3-data-skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Chainbase API helper for Web3 lookups, with expected network/API-key use and no hidden persistence or destructive behavior.

Before installing, understand that Web3 identifiers and any custom SQL you ask it to run will be sent to Chainbase along with the configured API key. Avoid submitting proprietary watchlists or sensitive address-query combinations unless you intend to share them with that service.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (13)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The README encourages activation on broad natural-language prompts like 'look up, analyze, or explore Web3/blockchain data' without clear boundaries, which can cause the skill to trigger in contexts the user did not intend. In an agent setting, overly broad routing increases the chance of unnecessary external API use, mis-scoped data retrieval, or the skill being selected for ambiguous prompts that should require clarification first.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill instructs the agent to run a shell script (scripts/chainbase.sh) but does not declare any permissions or allowed-tools scope. That creates an authorization mismatch where a reviewer or runtime may not understand that shell execution and outbound API access are required, increasing the chance of unintended command execution or policy bypass through an implicitly powerful skill.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger text is broad enough to match many normal conversations about wallets, prices, transactions, analytics, or 'look up' requests, which can cause the skill to activate in situations the user did not clearly intend. Because the skill can invoke shell-based API queries, over-invocation increases the risk of unnecessary data transmission to a third party and unnecessary execution of external requests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill directs the agent to send user-provided wallet addresses, ENS names, token identifiers, and even free-form SQL queries to Chainbase, but it does not warn that this data leaves the local environment and is processed by an external service. This creates a privacy and data-governance risk, especially if users provide sensitive addresses, proprietary watchlists, or custom analytical queries they do not expect to be shared.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-endpoints.md (reported line 7)May include surrounding context.

md
- **Web3 API**: `https://api.chainbase.online`
- **SQL API**: `https://api.chainbase.com/api/v1`
- **SQL Classic**: `https://api.chainbase.online/v1`

## Authentication

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-endpoints.md (reported line 297)May include surrounding context.

md
- **Web3 API**: `https://api.chainbase.online`
- **SQL API**: `https://api.chainbase.com/api/v1`
- **SQL Classic**: `https://api.chainbase.online/v1`

## Authentication

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-endpoints.md (reported line 6)May include surrounding context.

md
API_KEY="${CHAINBASE_API_KEY:-demo}"
BASE_URL="https://api.chainbase.online"
SQL_BASE_URL="https://api.chainbase.com/api/v1"
SQL_POLL_INTERVAL=2
SQL_POLL_MAX=30

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/api-endpoints.md (reported line 285)May include surrounding context.

md
API_KEY="${CHAINBASE_API_KEY:-demo}"
BASE_URL="https://api.chainbase.online"
SQL_BASE_URL="https://api.chainbase.com/api/v1"
SQL_POLL_INTERVAL=2
SQL_POLL_MAX=30

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/chainbase.sh (reported line 18)May include surrounding context.

sh
API_KEY="${CHAINBASE_API_KEY:-demo}"
BASE_URL="https://api.chainbase.online"
SQL_BASE_URL="https://api.chainbase.com/api/v1"
SQL_POLL_INTERVAL=2
SQL_POLL_MAX=30

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/chainbase.sh (reported line 62)May include surrounding context.

sh
api_call() {
  local call_method="$1" call_url="$2" call_header="$3" call_body="${4:-}"
  if [ "$call_method" = "POST" ]; then
    curl -s -X POST "$call_url" \
      -H "${call_header}: ${API_KEY}" \
      -H "Content-Type: application/json" \
      -d "$call_body"

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

All usage examples are written in Chinese, but the README does not state that the skill is Chinese-only or that users may choose another language. This can imply a language preference or constraint without user opt-in or justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This is a markdown file, so SQP-2 applies to missing user warnings in documentation. The reference describes authenticated external API usage and later documents endpoints that send addresses, ENS domains, transaction queries, and SQL bodies to Chainbase, but it provides no privacy or external-transmission warning to users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

This code performs network calls with curl and includes the API key in request headers, while also sending user-provided endpoint, query, or SQL/body content to an external service. Although the file has basic usage comments, it does not clearly disclose that provided data and credentials will be transmitted to a remote API.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.