ClawHub
Back to skill

Security audit

Crypto Market

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed crypto market-data and alert tool, but users should notice the dependency-install guidance, default-exchange mismatch, and local alert file before installing.

Install this only if you are comfortable with a local CLI that contacts crypto exchanges for public market data and stores alert settings under ~/.config/crypto/alerts.json. Prefer a virtual environment with a pinned CCXT version, specify --exchange explicitly until the default mismatch is fixed, and do not put real API keys into example code or committed files.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:25
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Locations:

  • SKILL.md:25
  • scripts/crypto.py:29-35

Vulnerability Type: Unpinned and unverified third-party dependency
Risk Level: Medium

Vulnerable Code

From SKILL.md:25:

bash
pip3 install ccxt --user

From scripts/crypto.py:29-35:

python
print("  方式1 - 用户安装（推荐）：")
print("    pip3 install ccxt --user")
print()
print("  方式2 - 系统安装（需管理员权限）：")
print("    pip3 install ccxt")
print()
print("  方式3 - macOS 外部管理环境：")
print("    pip3 install ccxt --user --break-system-packages")

Technical Analysis

The installation instructions retrieve the latest available ccxt package without specifying a reviewed version, enforcing package hashes, or using a dependency lock file. Consequently, the code installed by users can change after the Skill has been audited.

The instructions also recommend system-wide installation and the --break-system-packages option. These approaches weaken dependency isolation and can modify or conflict with packages managed by the operating system.

Although no malicious behavior was found in the project itself, its security depends on the mutable package served by the configured Python package index. A compromised package release, package-index account, or dependency in CCXT's transitive dependency chain could introduce attacker-controlled code. The script imports the installed package at startup:

python
try:
    import ccxt
    CCXT_AVAILABLE = True
except ImportError:
    CCXT_AVAILABLE = False

Malicious package code could therefore execute when ccxt or one of its imported dependencies is loaded.

Attack Path

  1. An attacker compromises the upstream package, a maintainer account, the package distribution channel, or a transitive dependency.
  2. The attacker publishes a malicious release that satisfies the unrestricted pip3 install ccxt request.
  3. A user follows the documented installation command, and pip downloads the mutable release without validating a ...[truncated 1287 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin CCXT to a specifically reviewed version, for example:
text
ccxt==X.Y.Z
  1. Generate and publish a dependency lock file containing cryptographic hashes. Require hash validation during installation, for example:
bash
python3 -m pip install --require-hashes -r requirements.txt
  1. Install dependencies inside a dedicated virtual environment rather than the user or system Python environment:
bash
python3 -m venv .venv
. .venv/bin/activate
python3 -m pip install --require-hashes -r requirements.txt
  1. Remove recommendations to use system-wide installation and --break-system-packages.
  2. Pin and audit transitive dependencies as part of the lock file.
  3. Add automated dependency vulnerability scanning and controlled dependency-update review.
  4. Optionally specify the expected package index explicitly and document a trusted internal mirror for managed deployments.
  5. Update the runtime dependency-help text in scripts/crypto.py so it presents only the hardened installation procedure.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

The documented behavior does not fully match the detected implementation: local persistence occurs despite no declared permissions, and the analyzer reports a default-exchange mismatch. Behavior mismatches are dangerous because they undermine user trust and can hide side effects such as local state writes, causing users to invoke actions under false assumptions about what the skill will do.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill documentation indicates behavior that reads and writes local files via alert persistence, but it declares no tool scope or permissions. Undeclared file access is dangerous because users and the hosting platform cannot accurately understand or constrain what the skill may modify on disk, increasing the risk of unexpected data exposure or tampering.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The document shows how to instantiate a CCXT exchange object with apiKey and secret placeholders for private API access, but it provides no warning about secure credential handling, secret storage, or the risks of exposing keys in code, logs, or version control. In a crypto-trading context, mishandled API credentials can enable unauthorized account access, trading, or fund loss, so even example code without safeguards materially increases misuse risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file’s description and all user-facing help/output strings are written exclusively in Chinese, indicating the skill is designed to operate in a single language. There is no option for user language selection or documentation that this is intentionally limited to a Chinese-speaking context, which conflicts with the language/locale policy requirement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

This markdown file documents a persistent configuration file at ~/.config/crypto/alerts.json and encourages manual editing, but it does not warn users that alert data is stored locally and could be altered or lost through manual changes. For a skill that affects user-maintained alert state, a brief disclosure about persistence and the risk of accidental corruption or deletion would improve user safety.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/crypto.py (reported line 60)May include surrounding context.

python
return None
    
    try:
        exchange_class = getattr(ccxt, exchange_id)
        exchange = exchange_class({
            'enableRateLimit': True,
        })

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest explicitly states 'Default exchange is Binance', which sets user expectations about the skill's baseline behavior. In the code, the argparse configuration sets the default exchange to 'okx', so running the tool without specifying an exchange uses a different service than advertised.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.