ClawHub
Back to skill

Security audit

Agent-Powered Carbon Credit Trading & CBAM Compliance

Security checks for vulnerabilities and agentic risk

Overview

The skill is a non-executable guide, but its examples mix sandbox claims with production API calls that can create wallets, move large sums, release escrow, and start trades.

Treat this as a high-risk integration guide. Do not copy and run the examples with a real GREENHELIX_API_KEY until you have confirmed the endpoint is sandbox, used test or least-privilege credentials, added dry-run and explicit approval checks, set transaction limits, and verified escrow release against authoritative registry and verifier records.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:2249
Finding

Production Financial Operations Are Presented Under Misleading Sandbox and Educational Framing

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:1018
Finding

Escrow Release Trusts Caller-Supplied Verification and Hard-Codes Transfer Confirmation

Content
View full analysis
0: # Partial release with penalty deductions penalties = sum( v.get("penalty_pct", 0) for v in sla_status.get("violations", []) if v.get("penalty_applicable") ) # Open dispute instead of releasing resp = session.post(f"{base_url}/v1", json={ "tool": "open_dispute", "input": { "escrow_id": escrow_id, "complainant_agent_id": buyer_id, "reason": "sla_violation", "details": { "violations": sla_status["violations"], "total_penalty_pct": penalties } } }) return {"status": "disputed", "dispute": resp.json()} # All conditions met -- release escrow resp = session.post(f"{base_url}/v1", json={ "tool": "release_escrow", "input": { "escrow_id": escrow_id, "released_by": buyer_id, "verification_reference": verification_result.get("credit_id"), "metadata": { "quality_score": verification_result["quality"]["com ...[truncated 2670 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:1119
Finding

Trade Workflow Lacks Input Validation, Idempotency, and Partial-Failure Recovery

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The guide describes code that can create escrows, transfer funds, send compliance-related messages, and trigger trading actions, but it does not prominently warn users that these examples may execute real financial and regulatory operations against production systems. In this context, lack of an explicit hazard warning materially increases the chance of accidental real-world transactions and compliance-impacting actions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The documentation makes contradictory trust claims: it says users can get started in a sandbox with no API key, while the examples are configured to use the production GreenHelix API with credentialed access. This mismatch can cause users to run examples believing they are harmless demos when they may actually send authenticated requests tied to real trading and compliance workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill instructs users to supply an API key for a third-party gateway but does not clearly warn that operational, financial, supplier, and compliance data will be transmitted off-platform. Because the domain involves sensitive trade and emissions data, users may disclose regulated or confidential information without informed consent or data handling review.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The guide simultaneously states that every example runs against the production API and that all examples work with a no-key sandbox. In a skill focused on financial/compliance automation, this ambiguity is dangerous because readers may unknowingly use production endpoints for real trades, escrow actions, or compliance submissions.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

The example code is designed to transmit authenticated requests and potentially sensitive carbon trading data to an external API endpoint. External transmission is expected for an integration guide, but in this case it becomes security-relevant because the guide understates the production nature of the endpoint and the possible real-world side effects of those requests.

Content

Scanner excerpt · SKILL.md (reported line 206)May include surrounding context.

md
import requests
import os

base_url = "https://api.greenhelix.net/v1"
api_key = os.environ["GREENHELIX_API_KEY"]

session = requests.Session()

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This later production configuration again hard-codes an external API base URL and uses a bearer token from the environment, enabling live authenticated transmission to a third-party service. In a guide that culminates in a 'go-live' workflow, that raises the risk of users copying code into real environments without fully appreciating that they are interacting with production systems.

Content

Scanner excerpt · SKILL.md (reported line 2249)May include surrounding context.

md
import os

# Configuration
BASE_URL = "https://api.greenhelix.net/v1"
API_KEY = os.environ["GREENHELIX_API_KEY"]

session = requests.Session()

Static analysis

No suspicious patterns detected.