Security audit

Baoziclaw

Security checks across malware telemetry and agentic risk

Overview

This skill is a finance-adjacent Solana betting integration whose artifacts are inconsistent and whose transaction-related behavior is under-scoped.

Review carefully before installing. Treat this as a high-impact crypto betting skill: only use it if you trust the external Baozi npm package, can inspect every generated transaction before signing, understand that wallet portfolio data may be queried, and are comfortable with affiliate attribution being added to bets. Do not allow autonomous betting or claiming without explicit user confirmation.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The skill builds a shell command string and executes `npx -y @baozi.bet/mcp-server` through `child_process`, introducing a remote code execution and supply-chain trust boundary inside the agent workflow. Because tool arguments are interpolated into a shell command, malformed input or package compromise could lead to command injection, arbitrary code execution, or execution of unreviewed remote code on the host.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The skill metadata claims Solana prediction-market functionality, but the body contains only placeholder/example content and a generic tool description. This mismatch can cause agents or operators to invoke the skill under false assumptions, increasing the risk of unintended activation, misuse, or unsafe future implementation being trusted without accurate documentation.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The inline documentation explicitly presents example/placeholder intent that contradicts the declared Baozi market purpose. In a financial or blockchain context, contradictory documentation is dangerous because an agent may select or apply the skill in the wrong workflow, potentially leading to unintended transaction-related behavior once real tools are added.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill metadata and description claim Solana prediction-market capabilities, but the implementation only exposes a trivial string-processing example tool. This mismatch can mislead users, integrators, or automated agents into trusting the package for financial operations it does not perform, creating supply-chain and operational risk through deceptive functionality claims.

Intent-Code Divergence

Low

Confidence: 91% confidence
Finding: The file presents itself as a real Baozi/OpenClaw skill in comments and metadata, but the code is only an example placeholder. Even without direct code execution risk, this kind of misleading packaging can cause unsafe assumptions during deployment, review, or dependency selection, especially in an ecosystem involving wallet or betting operations.

Description-Behavior Mismatch

Medium

Confidence: 86% confidence
Finding: The skill exposes a get-portfolio tool that reveals wallet positions and betting history, which is sensitive financial data. In a betting/markets skill this may be functionally related, but if the manifest or user-facing capability description does not clearly disclose portfolio access, users and integrators can be misled about the scope of data exposure.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: A hardcoded affiliate code is silently injected into bet placement, causing all user bets to be attributed to the developer without transparent disclosure or opt-in. This is dangerous because it creates an undisclosed financial conflict of interest and can manipulate transaction construction in a funds-related workflow.

Intent-Code Divergence

Low

Confidence: 93% confidence
Finding: The place-bet tool description says only that it places a bet, while the implementation always builds an affiliate-tagged transaction. Hiding or softening this behavior is risky in a financial context because users may authorize transactions without understanding that referral metadata benefiting the author is being embedded.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The skill encourages placing bets and claiming winnings on-chain without clearly warning users that these actions can transfer funds, incur irreversible transaction costs, and create regulatory or gambling-risk exposure. In an agent context, omission of these warnings increases the chance that users authorize financial actions without understanding the consequences.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The installation snippet instructs users to generate code that executes an external NPX package through a subprocess, but provides no warning that this runs remote package code and expands the host attack surface. In a skill ecosystem, this is risky because users may paste and run the snippet without realizing they are delegating trust to a network-fetched executable.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The invocation guidance is so vague that it does not define clear activation criteria or exclusions. For a skill associated with prediction markets and possible on-chain actions, ambiguous triggering can cause over-broad invocation, where an agent uses the skill in contexts that should require stricter user confirmation or different tooling.

Vague Triggers

Medium

Confidence: 96% confidence
Finding: The top-level description is a placeholder and does not constrain the skill's intended use. A vague description increases the chance that routing or selection systems will treat the skill as generally useful, which is especially risky when the advertised domain includes financial transactions on Solana.

Vague Triggers

Low

Confidence: 88% confidence
Finding: The placeholder usage example is overly broad and does not meaningfully scope when the skill should be used. While lower impact than the other issues, broad examples can still encourage accidental triggering or user misunderstanding about what actions the skill may perform.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The code constructs a shell command using toolName and JSON-stringified args, then executes it via exec against an external package fetched with npx. This is dangerous because shell-based invocation increases command injection risk and executing a remotely resolved package at runtime expands the trust boundary to external code with little user visibility.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The skill exposes betting, claims, and portfolio lookup operations without explicit safety prompts, despite handling actions that may affect funds or disclose financial activity. In a prediction-market skill this context makes the capability expected, but also raises the need for strong transparency and confirmation because mistakes can directly impact user assets or privacy.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.