ClawHub
Back to skill

Security audit

Bitpanda Official

Security checks for vulnerabilities and agentic risk

Overview

This Bitpanda skill is mostly consistent with a read-only account viewer, but its bundled CLI has a real argument-handling flaw that can execute local commands.

Review before installing. Do not run the bundled trades command with untrusted or agent-derived option values until --limit and other parameters are validated. Use a least-privilege read-only Bitpanda API key if available, avoid exposing command output in shared logs or transcripts, and prefer a sandboxed runtime with only the Bitpanda key available.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/bitpanda.sh:248
Finding

Arbitrary Command Execution Through Unvalidated --limit Arithmetic Evaluation

Content
View full analysis

Vulnerability Details

File Location: scripts/bitpanda.sh, lines 248–270
Vulnerability Type: Command injection through Bash arithmetic expansion
Risk Level: High

bash
cmd_trades() {
  require_api_key
  local operation="" asset_type="" limit=5 from="" to=""
  while [ $# -gt 0 ]; do
    case "$1" in
      --operation) operation="$2"; shift 2;;
      --asset-type) asset_type="$2"; shift 2;;
      --limit) limit="$2"; shift 2;;
      --from) from="$2"; shift 2;;
      --to) to="$2"; shift 2;;
      *) die "Unknown option: $1";;
    esac
  done

  local tmpdir
  tmpdir=$(mktemp -d)
  _CLEANUP_DIRS+=("$tmpdir")

  # Fetch ticker for asset type mapping (type field: cryptocoin, metal, stock, etc.)
  fetch_all_ticker_prices > "$tmpdir/ticker.json" &
  local ticker_pid=$!

  # Fetch transactions, auto-paginating until we have enough matches
  # When asset_type filter is active, collect more since filtering happens post-enrichment
  local collect_limit=$limit
  if [ -n "$asset_type" ]; then collect_limit=$((limit * 10)); fi

Technical Analysis

The --limit option accepts an arbitrary string and stores it in limit without validating that it is a positive integer. When --asset-type is nonempty, line 270 evaluates that value as part of Bash arithmetic expansion:

bash
collect_limit=$((limit * 10))

Bash can recursively interpret variable contents as arithmetic expressions. Arithmetic expressions can include array subscripts, and maliciously constructed subscripts can contain command substitutions. Consequently, this is not limited to malformed numeric input: a crafted --limit value can cause a local command to execute.

Quoting the value when it is initially assigned does not prevent this issue because the dangerous interpretation occurs later in the arithmetic context.

Attack Path

  1. The BITPANDA_API_KEY environment variable is present, allowing `r ...[truncated 1474 chars]
Remediation
View remediation

Remediation Suggestions

Validate --limit immediately after parsing and before any arithmetic evaluation. Require a canonical positive decimal integer and impose a reasonable upper bound:

bash
[[ "$limit" =~ ^[1-9][0-9]*$ ]] ||
  die "--limit must be a positive integer"

(( 10#$limit <= 1000 )) ||
  die "--limit must not exceed 1000"

collect_limit=$((10#$limit))
if [[ -n "$asset_type" ]]; then
  collect_limit=$((10#$limit * 10))
fi

Additional hardening should include:

  1. Validate every CLI option according to its expected type and allowed values.
  2. Check that options requiring a value have another argument before referencing $2.
  3. Restrict --operation to documented values such as buy and sell.
  4. Validate date parameters against an accepted ISO 8601 format.
  5. Reject control characters and unexpected syntax in identifiers and cursors.
  6. Add regression tests using malicious arithmetic inputs, including array-subscript command substitutions, and verify that no command executes.
  7. Run the Skill with the minimum filesystem, network, and environment access required for its read-only API functionality.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill invokes a bundled bash CLI and therefore has shell execution capability, but the manifest does not declare any explicit tool scope such as allowed tools or permissions. That omission weakens governance and review because consumers cannot easily tell that shell access is required, increasing the chance the skill is run in broader environments than intended.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill instructs the user to set a long-lived Bitpanda API key and immediately run account-querying commands, but it does not explicitly warn that sensitive portfolio and transaction data will be transmitted to Bitpanda and exposed within the agent runtime. In an agent context, financial holdings, balances, and trade history are highly sensitive, so lack of an explicit disclosure and handling guidance creates a real privacy and secret-management risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
85% confidence
Finding

The documentation instructs users to authenticate with an API key on every request but provides no guidance on protecting that key or avoiding exposure in logs, examples, or transcripts. In a skill that accesses wallet balances, transactions, and account data, this omission can lead to accidental credential leakage and privacy exposure even though the endpoints are read-only.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.