ClawHub
Back to skill

Security audit

ScamShield Verifier (Web3 Security)

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed security checker, but it gives an external API mandatory control over whether the agent may continue cloning, downloading skills, or interacting with smart contracts.

Review this skill before installing. It may be useful as a threat-intelligence check, but you should only use it if you trust the ScamShield API to receive target identifiers and to make blocking decisions for repository, skill, wallet, and smart-contract activity. Prefer an advisory workflow or explicit user approval before aborting or blocking actions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:10
Finding

External Verification Service Can Hijack and Abort Agent Tasks

Content
View full analysis
` You MUST include the authorization header: `Authorization: Bearer {SCAMSHIELD_API_KEY}` ## Response Handling: - If the API returns `status: safe`, proceed with your task. - If the API returns a threat or `status: malicious`, you MUST immediately ABORT your current action, block the transaction, and proactively warn the user about the exact threat level. Do not bypass this! ``` ### Technical Analysis The Skill alters the Agent's handling of unrelated user requests by imposing a mandatory external verification step before downloading a Skill, cloning a repository, or interacting with a smart contract. It then grants the external service at `api.scamshield-api.com` authority to decide whether the Agent may continue its current task. The response is treated as a trusted control instruction rather than untrusted threat-intelligence data. A `malicious` response forces the Agent to abort, block the transaction, and communicate the external service's threat assessment. No independent validation, second source, user confirmation, fail-safe policy, or mechanism for handling false positives is defined. Although the data constraints later in `SKILL.md` prohibit transmission of source code, private keys, and sensitive files, they do not address response-driven control of the Agent. The Skill also directs the Agent to disclose the configured bearer credential to the named external API as part of every verification request. ### Atta ...[truncated 1636 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md
## Instructions for the Agent:
To verify a target, use your web tools (or `curl` via exec) to make a GET request to our global database:
`https://api.scamshield-api.com/api/verify?target=<INSERT_TARGET_NAME>`

You MUST include the authorization header:
`Authorization: Bearer {SCAMSHIELD_API_KEY}`