ClawHub
Back to skill

Security audit

CSPR.trade MCP

Security checks for vulnerabilities and agentic risk

Overview

This skill is openly for DEX trading, but it asks users to run unpinned code and may sign remotely built blockchain transactions without enough local validation.

Review carefully before installing. Prefer the hosted read-only or quote workflows unless you understand the signing path. If using local signing, pin the npm package version, isolate the signer from unrelated files and environment variables, avoid inline private keys or mnemonics when possible, and verify transaction details with a trusted wallet or local decoder before signing.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:39
Finding

Unpinned npm Package Execution in Trading and Local Signer Modes

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:75
Finding

Remote-Built Transactions Can Be Signed Without Independent Payload Validation

Content
View full analysis
", key_source: "pem_file" }) ``` - Proceed to step 8 with the signed JSON. **If `sign_deploy` is NOT available** (no local signer configured): - Tell the user: "This is an unsigned transaction. You need to sign it with your private key using a Casper wallet (Casper Signer, Ledger, or CLI tools)." - "Once signed, provide the signed transaction JSON so I can submit it." - Never ask for or handle private keys directly. ``` ### Technical Analysis The workflow correctly requires user confirmation before signing, but it does not require the local signer or agent to independently decode and validate the unsigned deploy re ...[truncated 2370 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 254)May include surrounding context.

md
Apply these checks at every transaction step:

1. **Price impact**:
   - Below 1%: Normal, no warning needed.
   - 1–5%: Mention it but proceed normally.
   - 5–15%: Warn the user explicitly. Suggest a smaller trade amount.
   - Above 15%: Strongly discourage. Explain they will lose a significant portion to slippage.

Static analysis

No suspicious patterns detected.