T09 · Insecure Skill Coding Practices
Error
- Location
auto-deploy.js:13- Finding
Plaintext ClawHub Account Credentials Embedded in Deployment Script
- Content
View full analysis
- Remediation
View remediation
Security audit
Bsc Dev Monitor Skill
Security checks for vulnerabilities and agentic risk
Overview
The skill has a coherent wallet-monitoring purpose, but it ships live-looking payment and platform login secrets plus unsafe billing and deployment controls.
Do not install or run this package as-is. The publisher should revoke and rotate all exposed credentials, remove deployment account secrets from the distributed artifact, move payment operations behind a trusted server-side flow, require real payment verification, add user/tenant authorization for monitor operations, validate webhook destinations, and correct or remove unsupported safety-check claims.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T09 · Insecure Skill Coding Practices
Error
- Location
index.js:16- Finding
Hardcoded SkillPay API Key Exposed in Source, Documentation, and Payment URLs
- Content
View full analysis
`${encodeURIComponent(key)}=${encodeURIComponent(paymentData[key])}`) .join('&'); return `https://skillpay.me/pay?${queryString}`; } ``` The same key is used as an authentication header in `billing.js`: ```js const BILLING_API_URL = 'https://skillpay.me'; const API_KEY = 'sk_f072a786149bc07fc8730b4683dc00f3e050e72441922284ca803cdee2b994b5'; const SKILL_ID = '9469b85f-f40f-4ada-ad9c-bdd9db1167cc'; async function chargeUser(userId) { const resp = await fetch(`${BILLING_API_URL}/api/v1/billing/charge`, { method: 'POST', headers: { 'X-API-Key': API_KEY, 'Content-Type': 'application/json', }, body: JSON.stringify({ user_id: userId, skill_id: SKILL_ID, amount: 0.001, }), }); ``` ### Technical Analysis A reusable SkillPay API key is embedded in executable files and documentation. The active entry point additionally includes the key in every generated payment URL. URL query values are routinely retained by application logs, rev ...[truncated 1746 chars]- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
index.js:457- Finding
Payment Enforcement Can Be Bypassed with a Caller-Controlled Flag
- Content
View full analysis
- Remediation
View remediation
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
index.js:409- Finding
Monitor Operations and Detection History Lack Ownership Authorization
- Content
View full analysis
d.from.toLowerCase() === address.toLowerCase()); } return { status: 'success', total: history.length, records: history.slice(-limit) }; } ``` ```js case 'stop': return stopMonitor(input.monitor_id); case 'history': return getHistory(input); case 'status': const monitor = activeMonitors.get(input.monitor_id); if (monitor) { return { status: 'active', monitor_id: monitor.id, detected_count: monitor.detectedCount, runtime_seconds: Math.floor((Date.now() - monitor.startTime) / 1000) }; } return { status: 'not_found', monitor_id: input.monitor_id }; ``` ### Technical Analysis Monitor records contain `userId`, but stop and status operations do not compare it with an authenticated requester. History retrieval similarly does not apply a user or tenant boundary. A history request without an address returns records from the global in-memory `detectionHistory` array. This is broken object-level authorization. Possession of a monitor identifier is treated as sufficient authorization, and history access does not require even that identifier. Although monitor IDs include part of a UUID and are not trivially sequential, identifier entropy ...[truncated 1241 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
deploy.sh:29- Finding
Deployment Script Installs an Unpinned Third-Party CLI Globally
- Content
View full analysis
/dev/null; then echo "ClawHub CLI is not installed" echo "Installing..." npm install -g @clawhub/cli fi ``` ### Technical Analysis The deployment script installs the current registry-selected version of `@clawhub/cli` globally without a pinned version, lockfile, package integrity value, or explicit confirmation immediately before installation. An npm package may execute lifecycle scripts during installation. A compromised maintainer account, malicious replacement release, dependency compromise, or unexpected upstream change could therefore execute code with the deploying user's privileges. Global installation expands the effect beyond the project directory by modifying the user's global Node.js environment and executable path. ### Attack Path 1. An attacker compromises the upstream package, one of its dependencies, or its publication channel. 2. A user runs `deploy.sh` on a system where `clawhub` is not already installed. 3. The script automatically retrieves the registry-selected package version. 4. npm executes package installation and any permitted lifecycle scripts with the deploying user's privileges. 5. The malicious package can access files, environment variables, deployment credentials, and network resources available to that user. ### Impact Assessment A successful supply-chain compromise could execute arbitrary code with the privileges of the deployment account. Depending on that account, impact may include theft of deployment tokens, modification of published artifacts, filesystem changes, or compromise of other projects accessible to the user. No evidence established that the named package is currently malicious; the confirmed issue is the unsafe, unpinned, global installation process. ]]>- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (92)
Context-Inappropriate Capability
Critical
- Category
- Not specified by scanner
- Confidence
- 100% confidence
- Finding
The code embeds a plaintext email and password for platform access directly in source. Hardcoded credentials are trivially recoverable by anyone with file access, enabling account takeover, unauthorized uploads, and reuse attacks if the password is shared elsewhere.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The delivery report exposes a live-looking SkillPay API key directly in documentation, which is sensitive credential material and not necessary to publish in a public-facing report. If valid, anyone who obtains the file could abuse the payment integration, create fraudulent charges, inspect billing activity, or otherwise impersonate the skill's payment backend.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This is a direct credential exposure in markdown without any warning or handling guidance, making accidental leakage and reuse more likely. In the context of a monetized skill, exposed payment API credentials can enable unauthorized billing actions or compromise the integrity of the service's payment flow.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The guide exposes a live-looking email address and plaintext password directly in documentation, encouraging anyone with file access to reuse or misuse those credentials. Hardcoded credentials in deployment docs create immediate account-compromise risk and also normalize unsafe secret-handling practices for operators.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The document contains plaintext third-party login credentials and instructs the operator to use them to access an external site. Exposing credentials in deployment documentation creates immediate risk of unauthorized account access, account takeover, and downstream abuse unrelated to the skill’s stated monitoring functionality.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The markdown explicitly directs the operator to log in with included credentials, normalizing insecure credential sharing and handling. This increases the chance of credential leakage, unauthorized reuse, and compromise of the third-party service account.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The deployment instructions plainly expose account credentials for manual operational use, which is a direct secret disclosure. In the context of a distributable skill package, this is especially dangerous because anyone with access to the file can misuse the account or test the credentials elsewhere.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill extends beyond plain monitoring by integrating with an external payment service, yet the trust, privacy, and feature boundaries are not clearly declared. Combined with claimed but unverified security checks, this can cause users to overtrust the skill while their usage and payment data flows to third parties.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill extends beyond plain monitoring by integrating with an external payment service, yet the trust, privacy, and feature boundaries are not clearly declared. Combined with claimed but unverified security checks, this can cause users to overtrust the skill while their usage and payment data flows to third parties.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill extends beyond plain monitoring by integrating with an external payment service, yet the trust, privacy, and feature boundaries are not clearly declared. Combined with claimed but unverified security checks, this can cause users to overtrust the skill while their usage and payment data flows to third parties.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill extends beyond plain monitoring by integrating with an external payment service, yet the trust, privacy, and feature boundaries are not clearly declared. Combined with claimed but unverified security checks, this can cause users to overtrust the skill while their usage and payment data flows to third parties.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill extends beyond plain monitoring by integrating with an external payment service, yet the trust, privacy, and feature boundaries are not clearly declared. Combined with claimed but unverified security checks, this can cause users to overtrust the skill while their usage and payment data flows to third parties.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill extends beyond plain monitoring by integrating with an external payment service, yet the trust, privacy, and feature boundaries are not clearly declared. Combined with claimed but unverified security checks, this can cause users to overtrust the skill while their usage and payment data flows to third parties.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
The skill extends beyond plain monitoring by integrating with an external payment service, yet the trust, privacy, and feature boundaries are not clearly declared. Combined with claimed but unverified security checks, this can cause users to overtrust the skill while their usage and payment data flows to third parties.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
A live payment API key is embedded directly in the manifest, making it exposed to anyone who can read or redistribute the skill package. Exposed payment credentials can enable unauthorized charges, account abuse, impersonation of the skill, and compromise of associated billing data or funds.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script automatically transmits embedded credentials to a remote login endpoint without any warning, prompt, or consent from the operator. This creates a high risk of unintended credential use and silent account access whenever the script is run.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file is a deployment/publishing script that logs into a third-party platform and uploads a ZIP, which is unrelated to the advertised wallet-monitoring functionality. This mismatch is dangerous because users reviewing or executing the skill may unknowingly run code that performs account actions and publishes artifacts to a remote service.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script contains remote login and skill-publication capabilities that are not necessary for monitoring BSC wallet transfers. Unrelated privileged functionality increases attack surface and can be abused to exfiltrate local artifacts or perform unauthorized actions against the platform account.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 100% confidence
- Finding
On login failure, the script prints the full email and password to the console as part of manual deployment instructions. Console output is often captured in terminal history, logs, CI systems, or screenshots, causing immediate credential disclosure.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file embeds a complete third-party billing workflow, including a hardcoded API key and automatic charge logic, even though the declared skill purpose is BSC wallet monitoring. This mismatch is a strong indicator of hidden monetization behavior or unauthorized charging capability unrelated to the advertised function, making the skill materially more dangerous in context.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The charge operation directly attempts to bill the user as part of normal request handling, with no confirmation step, no visible authorization flow, and no user-facing warning. In the context of a wallet-monitoring skill, this increases the risk of unauthorized or deceptive charges and erodes any expectation of informed consent.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest explicitly says the skill supports webhook notifications, and monitors accept a webhook_url field. However, during detection the code only logs results and appends them to in-memory history; it never sends an HTTP request to the configured webhook URL.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
These lines send credential-bearing requests with a bearer secret to an external payment API without meaningful user disclosure or isolation. If the skill code is shared or reused, the secret can be abused to query or manipulate payment-related operations, and users may be unaware their identifiers and payment metadata are being transmitted externally.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill exfiltrates monitoring events to arbitrary user-supplied webhook endpoints without explicit warning, validation, or destination restrictions. This can leak wallet-monitoring activity and billing metadata to attacker-controlled servers, and can also be abused as an SSRF-like outbound request primitive to unexpected hosts.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The document introduces a billing and charging subsystem, including payment provider configuration and an API key, which materially expands the skill from passive wallet monitoring into monetized payment handling. This is dangerous because it creates undisclosed financial side effects and exposes a live-looking secret in documentation, increasing the risk of unauthorized charges or abuse if reused elsewhere.
- Content
Static analysis
Detected: suspicious.exposed_secret_literal
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- auto-deploy.js:77
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- BILLING-UPDATE-COMPLETE.md:17
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- billing.js:6
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- index-enhanced.js:13
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- index-updated.js:16
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- index.js:17
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- mock-deploy.js:18
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- README.md:72
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- SKILL.md:12