T05 · Unauthorized Access and Privilege Escalation
Error
- Location
a2a-agent-full.js:112- Finding
Unauthenticated Network Requests Can Execute Wallet-Backed SHIB Transfers
- Content
View full analysis
- Remediation
View remediation
Security audit
A2A SHIB Payment System
Security checks for vulnerabilities and agentic risk
Overview
This skill is a real wallet-backed crypto payment agent, but its default server can execute SHIB transfers without authentication and its documentation overstates the security of escrow and production readiness.
Do not install this for real funds unless you first remove or secure the unauthenticated default agent, require authentication and per-request authorization on every transfer path, use only a low-balance hot wallet, stop printing or plaintext-storing credentials, and treat the escrow feature as an off-chain tracker until it verifies or controls funds on-chain.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (7)
T03 · Remote Payload Retrieval and Execution
Error
- Location
DEPLOYMENT.md:185- Finding
Deployment Instructions Execute Mutable Remote Content as Root
- Content
View full analysis
- Remediation
View remediation
T06 · System Persistence
Error
- Location
deploy-local.sh:26- Finding
Deployment Workflows Install Boot and Scheduled Persistence
- Content
View full analysis
/dev/null; echo "0 * * * * cd $(pwd) && ./backup.sh") | crontab - ``` ### Technical Analysis The “Quick Local” deployment installs a system-wide systemd unit and enables it at boot. The recommended deployment procedure also modifies the user's crontab to execute `backup.sh` every hour. An always-on service can be reasonable for an explicitly selected production deployment, but it is not required for the Skill's fundamental payment functionality and exceeds the minimum privileges needed for a local quick start. It also causes wallet-backed code to continue executing across sessions and reboots. The unit executes source from a user-controlled working directory. If those files are subsequently replaced or modified, the changed code will run when the service starts or restarts. The package directory shown in the audit does not include ...[truncated 999 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
a2a-agent-production.js:341- Finding
API Keys Are Stored and Printed in Plaintext
- Content
View full analysis
{ if (agent.enabled) { console.log(` ${id}:`); console.log(` API Key: ${agent.apiKey}`); console.log(` Permissions: ${agent.permissions.join(', ')}`); console.log(` Max Payment: ${agent.maxPaymentAmount} SHIB`); } }); ``` ### Technical Analysis API keys are retained in reversible plaintext in `auth-config.json`. `fs.writeFileSync()` is called without an explicit restrictive mode, so effective permissions depend on the process umask and any pre-existing file permissions. The production server also prints every enabled API key in full during startup. Under systemd, Docker, cloud logging, or terminal recording, these values can persist in journals and centralized log systems long after startup. Because some keys include payment permissions, disclosure of a key can directly authorize cryptocurrency transfers up to the affected accoun ...[truncated 801 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
a2a-agent-production.js:95- Finding
Shared Mutable Request Identity Creates a Cross-Request Authorization Race
- Content
View full analysis
{ // Inject agentId into executor before handling request if (req.agentAuth) { executor.currentAgentId = req.agentAuth.agentId; } jsonRpcMiddleware(req, res, next); }); ``` ### Technical Analysis A single executor instance serves all requests, but the authenticated identity is stored in `executor.currentAgentId`, a mutable shared property. It is not bound to an individual request. Node.js can interleave asynchronous handling of multiple requests. A second authenticated request can overwrite `currentAgentId` while the first request is still being processed. The executor may then authorize, rate-limit, or audit an action under the wrong account. The middleware also writes `req.body.params.agentId`, but the executor does not read identity from that request-specific value. ### Attack Path 1. Attacker A has a valid low-privilege API key. 2. Agent B has a key with broader permissions or a larger payment limit. 3. A and B submit overlapping JSON-RPC requests. 4. Middleware repeatedly overwrites the shared `executor.currentAgentId`. 5. One request's executor invocation reads the identity assigned by the other request. 6. Authorization, rate limiting, or audit attribution occurs against ...[truncated 496 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
escrow.js:82- Finding
Escrow Funding Accepts Arbitrary Transaction Hashes Without On-Chain Verification
- Content
View full analysis
')); } else { const [, escrowId, txHash] = match; const escrow = escrowSystem.fund(escrowId, txHash); eventBus.publish(createMessage( `✅ Escrow funded!\n\nID: ${escrowId}\nState: ${escrow.state}\nTx: ${txHash}\n\nNext: Both parties must approve with "escrow approve ${escrowId}"` )); } } ``` ### Technical Analysis The `fund()` method treats any supplied string matching the loose `0x\w+` pattern as proof of payment. It does not query Polygon or verify: - That the transaction exists. - That it succeeded and reached sufficient confirmation depth. - That it is on the expected chain. - That it transfers the configured token. - That the amount matches the escrow amount. - That sender and recipient correspond to the escrow parties. - That the transaction hash has not already funded another escrow. Consequently, the implementation is an off-chain state marker rather than a trustless escrow mechanism. The stored state and success message can falsely represent an unfund ...[truncated 781 chars]- Remediation
View remediation
other
Warning
- Location
monitor-github.sh:108- Finding
Repository Monitor Sends Notifications to a Hardcoded Third-Party Telegram Recipient
- Content
View full analysis
/dev/null || true fi ``` ### Technical Analysis When repository activity changes, the script invokes the OpenClaw messaging tool and sends the alert to the fixed Telegram identifier `5275167911`. The destination is not supplied by the user or derived from local configuration. The transmitted content appears limited to public GitHub repository statistics, issue details, pull request metadata, and the repository URL. No private key or API credential exfiltration was identified in this path. Nevertheless, the fixed recipient creates an unexpected external side effect and discloses that the user is monitoring and running automation for the repository. Error output is suppressed and failures are ignored, reducing visibility into this outbound operation. ### Attack Path 1. A user runs `monitor-github.sh` in an OpenClaw environment with Telegram messaging configured. 2. The script queries GitHub and detects new stars, forks, issues, or pull requests. 3. It constructs an alert containing repository activity. 4. `openclaw message send` transmits the alert to the hardcoded Telegram account. 5. The user may not realize that information was sent to a third-party recipient because errors are discarded. ### Impact Assessment The fixed recipient receives repository monitoring events and contextual execution information. The observed payload contains public repository data rather than secrets, so the confidentiality impact is limited, but t ...[truncated 68 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (189)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 95% confidence
- Finding
Mounting
.env.localinto the container exposes wallet credentials and other secrets to the runtime environment and to anyone who gains access to the container or host mount. In a crypto payment system, those credentials may directly control funds, making the impact of leakage severe.- Content
md docker run -d \ --name shib-agent \ -p 8003:8003 \ -v $(pwd)/.env.local:/app/.env.local \ -v $(pwd)/audit-logs:/app/audit-logs \ -v $(pwd)/escrow-state.json:/app/escrow-state.json \ -v $(pwd)/negotiation-state.json:/app/negotiation-state.json \
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 96% confidence
- Finding
curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash -downloads and executes a remote script with root privileges in a single step, creating a supply-chain and chaining-abuse risk. If the remote source, network path, or DNS is compromised, arbitrary code would run as root on the deployment host.- Content
md ssh user@your-vps-ip # 2. Install dependencies curl -fsSL https://deb.nodesource.com/setup_22.x | sudo -E bash - sudo apt-get install -y nodejs git # 3. Clone repo
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instructions tell the operator to place a Polygon private key into
.env.localwithout a strong, prominent warning about the sensitivity of that secret. Because this is a cryptocurrency payment agent, compromise of the private key could directly enable theft of funds or unauthorized transactions.- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The guide explicitly instructs users to edit
.env.localand add a private key, which creates a high-value plaintext secret on disk. For a blockchain payment agent, exposure of that file can immediately enable unauthorized transactions and theft.- Content
md cd clawd/skills/shib-payments # 4. Configure cp .env.example .env.local nano .env.local # Add your private key # 5. Install dependencies
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
Prompting the operator to open
.env.localin an editor to add a private key reinforces insecure secret handling without emphasizing the risk. The surrounding skill context increases danger because the secret controls on-chain assets.- Content
md # 4. Configure cp .env.example .env.local nano .env.local # Add your private key # 5. Install dependencies npm install
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 82% confidence
- Finding
This section documents
.env.localas the location forPOLYGON_PRIVATE_KEY, which means sensitive credentials are expected to reside in a local plaintext file. Whilechmod 600helps, storing cryptocurrency signing material this way still carries meaningful residual risk if the host is compromised or backups leak.- Content
Environment Variables:
bash # .env.local (chmod 600) POLYGON_WALLET_ADDRESS=0x... POLYGON_PRIVATE_KEY=0x... NODE_ENV=production
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 92% confidence
- Finding
Listing
.env.localunder files to back up increases the chance that wallet private keys will be copied into less-protected backup locations. Backup sprawl is a common source of secret compromise, and here it could expose the key controlling payment funds.- Content
audit-logs/*.jsonl
Wallet (backup once, store securely)
.env.local
text **Automated Backup Script:**
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation makes strong claims about trustless escrow, negotiation, reputation, low-cost on-chain payments, and framework-agnostic behavior, while the analyzed behaviors indicate materially different functionality. For a financial skill, this mismatch is dangerous because users or agents may trust it to handle real funds or security guarantees that are not actually implemented, leading to loss of money, unsafe deployment, or overexposure of host capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation makes strong claims about trustless escrow, negotiation, reputation, low-cost on-chain payments, and framework-agnostic behavior, while the analyzed behaviors indicate materially different functionality. For a financial skill, this mismatch is dangerous because users or agents may trust it to handle real funds or security guarantees that are not actually implemented, leading to loss of money, unsafe deployment, or overexposure of host capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation makes strong claims about trustless escrow, negotiation, reputation, low-cost on-chain payments, and framework-agnostic behavior, while the analyzed behaviors indicate materially different functionality. For a financial skill, this mismatch is dangerous because users or agents may trust it to handle real funds or security guarantees that are not actually implemented, leading to loss of money, unsafe deployment, or overexposure of host capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documentation makes strong claims about trustless escrow, negotiation, reputation, low-cost on-chain payments, and framework-agnostic behavior, while the analyzed behaviors indicate materially different functionality. For a financial skill, this mismatch is dangerous because users or agents may trust it to handle real funds or security guarantees that are not actually implemented, leading to loss of money, unsafe deployment, or overexposure of host capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation makes strong claims about trustless escrow, negotiation, reputation, low-cost on-chain payments, and framework-agnostic behavior, while the analyzed behaviors indicate materially different functionality. For a financial skill, this mismatch is dangerous because users or agents may trust it to handle real funds or security guarantees that are not actually implemented, leading to loss of money, unsafe deployment, or overexposure of host capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documentation makes strong claims about trustless escrow, negotiation, reputation, low-cost on-chain payments, and framework-agnostic behavior, while the analyzed behaviors indicate materially different functionality. For a financial skill, this mismatch is dangerous because users or agents may trust it to handle real funds or security guarantees that are not actually implemented, leading to loss of money, unsafe deployment, or overexposure of host capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation makes strong claims about trustless escrow, negotiation, reputation, low-cost on-chain payments, and framework-agnostic behavior, while the analyzed behaviors indicate materially different functionality. For a financial skill, this mismatch is dangerous because users or agents may trust it to handle real funds or security guarantees that are not actually implemented, leading to loss of money, unsafe deployment, or overexposure of host capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation makes strong claims about trustless escrow, negotiation, reputation, low-cost on-chain payments, and framework-agnostic behavior, while the analyzed behaviors indicate materially different functionality. For a financial skill, this mismatch is dangerous because users or agents may trust it to handle real funds or security guarantees that are not actually implemented, leading to loss of money, unsafe deployment, or overexposure of host capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation makes strong claims about trustless escrow, negotiation, reputation, low-cost on-chain payments, and framework-agnostic behavior, while the analyzed behaviors indicate materially different functionality. For a financial skill, this mismatch is dangerous because users or agents may trust it to handle real funds or security guarantees that are not actually implemented, leading to loss of money, unsafe deployment, or overexposure of host capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation makes strong claims about trustless escrow, negotiation, reputation, low-cost on-chain payments, and framework-agnostic behavior, while the analyzed behaviors indicate materially different functionality. For a financial skill, this mismatch is dangerous because users or agents may trust it to handle real funds or security guarantees that are not actually implemented, leading to loss of money, unsafe deployment, or overexposure of host capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation makes strong claims about trustless escrow, negotiation, reputation, low-cost on-chain payments, and framework-agnostic behavior, while the analyzed behaviors indicate materially different functionality. For a financial skill, this mismatch is dangerous because users or agents may trust it to handle real funds or security guarantees that are not actually implemented, leading to loss of money, unsafe deployment, or overexposure of host capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documentation makes strong claims about trustless escrow, negotiation, reputation, low-cost on-chain payments, and framework-agnostic behavior, while the analyzed behaviors indicate materially different functionality. For a financial skill, this mismatch is dangerous because users or agents may trust it to handle real funds or security guarantees that are not actually implemented, leading to loss of money, unsafe deployment, or overexposure of host capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation makes strong claims about trustless escrow, negotiation, reputation, low-cost on-chain payments, and framework-agnostic behavior, while the analyzed behaviors indicate materially different functionality. For a financial skill, this mismatch is dangerous because users or agents may trust it to handle real funds or security guarantees that are not actually implemented, leading to loss of money, unsafe deployment, or overexposure of host capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation makes strong claims about trustless escrow, negotiation, reputation, low-cost on-chain payments, and framework-agnostic behavior, while the analyzed behaviors indicate materially different functionality. For a financial skill, this mismatch is dangerous because users or agents may trust it to handle real funds or security guarantees that are not actually implemented, leading to loss of money, unsafe deployment, or overexposure of host capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documentation makes strong claims about trustless escrow, negotiation, reputation, low-cost on-chain payments, and framework-agnostic behavior, while the analyzed behaviors indicate materially different functionality. For a financial skill, this mismatch is dangerous because users or agents may trust it to handle real funds or security guarantees that are not actually implemented, leading to loss of money, unsafe deployment, or overexposure of host capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation makes strong claims about trustless escrow, negotiation, reputation, low-cost on-chain payments, and framework-agnostic behavior, while the analyzed behaviors indicate materially different functionality. For a financial skill, this mismatch is dangerous because users or agents may trust it to handle real funds or security guarantees that are not actually implemented, leading to loss of money, unsafe deployment, or overexposure of host capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The documentation makes strong claims about trustless escrow, negotiation, reputation, low-cost on-chain payments, and framework-agnostic behavior, while the analyzed behaviors indicate materially different functionality. For a financial skill, this mismatch is dangerous because users or agents may trust it to handle real funds or security guarantees that are not actually implemented, leading to loss of money, unsafe deployment, or overexposure of host capabilities.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation makes strong claims about trustless escrow, negotiation, reputation, low-cost on-chain payments, and framework-agnostic behavior, while the analyzed behaviors indicate materially different functionality. For a financial skill, this mismatch is dangerous because users or agents may trust it to handle real funds or security guarantees that are not actually implemented, leading to loss of money, unsafe deployment, or overexposure of host capabilities.
- Content
Static analysis
No suspicious patterns detected.