ClawHub
Back to skill

Security audit

Bitpanda V2

Security checks for vulnerabilities and agentic risk

Overview

The skill is a legitimate Bitpanda portfolio helper, but it handles financial credentials and private account data with under-disclosed storage and output risks.

Review this skill before installing. Use a least-privilege Bitpanda API key if available, avoid passing secrets as command-line arguments, avoid storing the key permanently in shell profile files unless you understand the exposure, and treat all command output as private financial data. Rotate or revoke the key if it is pasted into logs, chats, dotfiles, screenshots, or shared terminals.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/bitpanda.sh:164
Finding

User-Controlled jq Filter Injection in the Price Command

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

  1. Copia la chiave e salvala

Configurazione Variabile d'Ambiente

PowerShell:

powershell
$env:BITPANDA_API_KEY = "tua-api-key-qui"
# Per renderla permanente:
[System.Environment]::SetEnvironmentVariable("BITPANDA_API_KEY", "tua-api-key-qui", "User")

Bash (Linux/Mac):

bash
export BITPANDA_API_KEY="tua-api-key-qui"
# Per renderla permanente, aggiungi a ~/.bashrc o ~/.zshrc:
echo 'export BITPANDA_API_KEY="tua-api-key-qui"' >> ~/.bashrc

🛠️ Comandi Disponibili

balances - Wallet Crypto con Saldi > 0

Mostra tutti i wallet crypto/commodity/security con saldo maggiore di zero.

Endpoint: /v1/asset-wallets (filtrato per balance > 0)

Esempio:

bash
bitpanda.sh balances

Output: JSON array con solo gli asset che possiedi in quantità significativa. Include:

  • Cryptocoin (BTC, ETH, LTC, etc.)
  • Commodity/Metals (XAU-Gold, XAG-Silver)
  • Security/Stocks (AMD, ARM, QCOM, etc.)
  • ETF e altri prodotti

data - Portfolio Complet

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill instructs users to create and use a Bitpanda API key to access sensitive financial portfolio and trade data, but it does not explicitly warn that command output may expose holdings, transaction history, and other private account information in shell history, logs, screenshots, or shared terminals. In a portfolio-management context, this omission increases the risk of unintentional disclosure of sensitive financial data even if the API usage itself is legitimate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation recommends storing the Bitpanda API key persistently in user environment settings and shell startup files, but it does not warn about the risks of long-lived secrets in plaintext configuration files. This can expose the key to other local users, backups, shell inspection, dotfile syncing, or accidental publication, leading to unauthorized access to account data.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.

md
**Soluzione:** 
- Windows: Installa via Chocolatey (`choco install jq`) o scarica da [stedolan.github.io/jq](https://stedolan.github.io/jq/)
- Mac: `brew install jq`
- Linux: `sudo apt install jq` (Debian/Ubuntu)

### Output JSON Non Formattato
**Causa:** `jq` non funziona correttamente.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script retrieves a sensitive API key from an environment variable or argument and transmits it in outbound HTTPS requests, but the help text does not clearly warn users that credentials will be used and sent to a remote service. In a portfolio-management skill handling financial account data, that omission can lead to unsafe operator assumptions, accidental credential exposure via command-line arguments, or use in environments where outbound credential transmission is not expected.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

Comments, errors, and the help output are consistently Italian-language only, and there is no indication that the tool is region-specific or that users may select another language. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.