Security checks for vulnerabilities and agentic risk
Overview
This is a coherent Turbos Finance SDK guide, but users should treat its DeFi transaction and wallet examples as high-risk and verify dependencies before use.
Install only from the intended publisher/source, pin reviewed versions of clawhub, turbos-clmm-sdk, and @mysten/sui, and use testnet or simulation before any signed mainnet transaction. Do not expose mnemonics or private keys to an agent or SDK process unless you intentionally accept that risk.
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
T08 · Insecure Dependencies
Warning
Location
README.md:7
Finding
Unpinned Third-Party Package Installation and Execution
Content
View full analysis
Vulnerability Details
File Locations:
README.md:7-9
SKILL.md:34-38
Vulnerability Type: Unpinned and mutable third-party dependencies Risk Level: Medium
Vulnerable Code in README.md:7-9:
bash
npx clawhub install turbos
Vulnerable Code in SKILL.md:34-38:
bash
pnpm add turbos-clmm-sdk @mysten/sui
Technical Analysis
Both installation examples resolve packages without exact versions, lockfile enforcement, integrity hashes, or package-provenance verification.
The npx command may download and execute the version of clawhub currently resolved by the package registry. Similarly, pnpm add installs mutable versions of turbos-clmm-sdk, @mysten/sui, and their transitive dependencies. Consequently, the code executed by users can differ from the code that was available when this Skill was reviewed.
This is particularly sensitive because the installed SDK is intended to construct financial transactions, derive wallet keypairs, and submit signed Sui transactions. A compromised package version or transitive dependency could execute lifecycle scripts during installation or manipulate application behavior at runtime.
The audit did not establish that any referenced package is currently malicious. The vulnerability is the absence of controls that ensure users install a known, reviewed dependency set.
Attack Path
An attacker compromises a referenced package, a transitive dependency, or the relevant package-registry account.
The attacker publishes a malicious version that can be selected by the unpinned installation command.
A user follows the documented npx or pnpm add command.
The package manager downloads the attacker-controlled version.
Malicious code executes through an installation lifecycle script or when the SDK is imported and used.
The code runs with the privileges of the installing user and may access application files, environm
...[truncated 1122 chars]
Remediation
View remediation
Remediation Suggestions
Pin every direct dependency and CLI tool to an exact, reviewed version rather than relying on registry defaults.
Replace the CLI example with an explicitly versioned invocation, such as:
bash
Commit the generated lockfile and require reproducible installation with:
bash
pnpm install --frozen-lockfile
Review and pin transitive dependencies through the lockfile, and use package-manager overrides when necessary.
Verify package signatures, provenance attestations, registry ownership, and integrity metadata before updating versions.
Run dependency vulnerability and malware scanning in CI for every dependency update.
Disable package lifecycle scripts where compatible with the dependencies, or review required scripts before allowing them to execute.
Isolate package installation and transaction-building services with least-privilege filesystem, environment, and network access.
Keep private keys and mnemonics outside the SDK process where possible, using a wallet or external signer that displays and confirms the final transaction contents.
The README instructs users to run npx clawhub install turbos without pinning a specific version of the installer or package, which can cause different code to be fetched and executed over time. Because npx may download and run the latest remote package, a compromised upstream package, typosquat, or malicious update could lead to arbitrary code execution on the user's machine during installation.
Content
No source excerpt is available for this finding.
Context-Inappropriate Capability
Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding
The manifest describes a skill for integrating the Turbos Finance CLMM SDK for pools, swaps, positions, fees, and liquidity workflows. While transaction-building and on-chain interaction are in scope, exposing mnemonic generation and key derivation helpers adds wallet-secret management capability that is broader than necessary for an SDK integration guide and introduces sensitive-account functionality not implied by the stated purpose.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding
The skill includes examples for swaps, liquidity changes, fee collection, burns, and signed transaction execution without any explicit warning that these actions move funds and may be irreversible on-chain. An agent or developer following the examples could execute real mainnet transactions, causing unintended asset loss, slippage losses, or permanent position changes.
