ClawHub
Back to skill

Security audit

Use Arc

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent Arc development guidance, but it includes an unsafe remote installer command and a contradictory private-key deployment example that users should review carefully.

Install only if you are comfortable reviewing or replacing the Foundry install command with a verified installation method, and do not use the shown private-key CLI deployment pattern for Arc Testnet or any non-local environment. Prefer an encrypted keystore, hardware wallet, or interactive signer for deployments.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:71
Finding

Unverified Remote Script Piped Directly into Bash

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 71
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code:

bash
curl -L https://foundry.paradigm.xyz | bash && foundryup

Technical Analysis

The installation instruction uses curl -L to retrieve mutable content from an external URL and passes the response directly to Bash. Redirect following is enabled, so code returned by either the original server or any server in the redirect chain is executed immediately.

The payload is not pinned to a version, saved for inspection, checked against a cryptographic digest, or verified with a trusted digital signature. Consequently, the code actually executed can change after the Skill has been reviewed. Although installing Foundry is relevant to the declared smart-contract development workflow and the named domain appears associated with Foundry, direct remote-to-shell execution is not required to provide that functionality.

Attack Path

  1. A user or agent follows the Foundry setup instructions.
  2. The command requests content from https://foundry.paradigm.xyz and follows redirects.
  3. The source endpoint, hosting infrastructure, DNS resolution, or redirect destination is compromised or otherwise serves altered content.
  4. The altered response is streamed directly into Bash without inspection or integrity verification.
  5. The malicious script executes with the privileges of the user running the command.
  6. The payload can access data and perform operations available to that user, potentially including reading project files and wallet-related secrets, modifying files, installing additional software, or initiating network connections.

Impact Assessment

Successful exploitation provides arbitrary command execution under the invoking user's account. The precise scope depends on that account's permissions and environment. Potentially exposed assets i ...[truncated 516 chars]

Remediation
View remediation

Remediation Suggestions

Replace the curl | bash workflow with a verifiable installation process:

  1. Obtain a version-pinned release artifact from the project's authenticated official release channel.
  2. Download the artifact to a local file rather than streaming it into a shell.
  3. Verify it against a checksum or cryptographic signature published through an independently trusted channel.
  4. Abort installation if verification fails.
  5. Inspect the installer or use a reputable package manager where practical.
  6. Execute installation with an unprivileged account and request elevated privileges only for narrowly defined operations when necessary.
  7. Pin the Foundry version to reduce unreviewed supply-chain changes and document how users can update it safely.

At minimum, separate retrieval from execution and display an explicit warning that externally downloaded installation code must be authenticated before it is run.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The instruction curl -L https://foundry.paradigm.xyz | bash tells users to fetch and immediately execute a remote script without verification. This creates a supply-chain execution risk: if the upstream host, DNS, transport, or script delivery path is compromised, users may run arbitrary code on their machine simply by following the skill.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

bash
# Install Foundry
curl -L https://foundry.paradigm.xyz | bash && foundryup

# Deploy
# For local testing only - never pass private keys as CLI flags in deployed environments (including testnet/staging)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The description says to use the skill whenever "Arc or Arc Testnet is mentioned" and lists triggers like "Arc" and "stable fees." These terms are not tightly scoped to a specific command or context, and the file provides no exclusion conditions or negative examples, so the skill could activate on incidental mentions rather than clear Arc-building requests.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The deployment example explicitly shows forge create ... --private-key $PRIVATE_KEY --broadcast for Arc Testnet, which contradicts the skill's own rule that private keys must not be passed as CLI flags in non-local environments, including testnet and staging. Even when sourced from an environment variable, CLI flags can leak through shell history, process listings, CI logs, or wrapper tooling, normalizing an unsafe operational pattern for users.

Content

No source excerpt is available for this finding.