Security audit

Bsc Dev Monitor Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent wallet-monitoring purpose, but it ships exposed payment and ClawHub credentials plus deployment and billing behavior that needs review before installation.

Review this skill before installing or running it. The publisher should rotate the exposed API keys and ClawHub password, remove deployment credentials from the package, replace secrets with environment-based configuration, validate webhook destinations, and either implement or remove the advertised safety and filtering controls.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (7)

T09 · Insecure Skill Coding Practices

Error

Location: auto-deploy.js:13
Finding: Plaintext ClawHub Account Credentials Embedded and Logged
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: index.js:16
Finding: Hard-Coded SkillPay and BSCScan API Keys
Content: View full analysis
`${encodeURIComponent(key)}=${encodeURIComponent(paymentData[key])}`) .join('&'); return `https://skillpay.me/pay?${queryString}`; ``` ### Technical Analysis Both keys are stored in distributable source code, and the SkillPay key is repeated in documentation and metadata. The SkillPay key is additionally inserted into a query string returned to users. Query-string secrets can be retained in browser history, reverse-proxy logs, application analytics, screenshots, and referrer data. The same SkillPay key is used as a bearer credential during payment verification. Consequently, treating it as public configuration defeats the confidentiality expected of an API authentication secret. ### Attack Path 1. An attacker inspects any distributed source or documentation file containing the keys. 2. The attacker extracts the SkillPay and BSCScan credenti ...[truncated 610 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: index.js:457
Finding: Payment Authorization Can Be Bypassed with a Caller-Controlled Boolean
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: index.js:254
Finding: Unrestricted Webhook Destination Enables Server-Side Request Forgery
Content: View full analysis
{ const postData = JSON.stringify(data); const options = { hostname: new URL(url).hostname, port: 443, path: new URL(url).pathname, method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(postData), 'User-Agent': 'BSCDevMonitor/1.0' } }; const req = https.request(options, (res) => { let responseData = ''; res.on('data', (chunk) => { responseData += chunk; }); res.on('end', () => { if (res.statusCode >= 200 && res.statusCode < 300) { resolve({ success: true, statusCode: res.statusCode }); } else { reject(new Error(`Webhook failed with status ${res.statusCode}`)); } }); }); req.on('error', reject); req.write(postData); req.end(); }); } ``` The URL is copied directly from caller input: ```js const { address, name = 'Unnamed Monitor', duration = 86400, billing_mode = 'per_detection', webhook_url = null, user_id } = input; // ... const monitor = { id: monitorId, address: address.toLowerCase(), name, startTime, endTime, duration, billingMode: billing_mode, webhookUrl: webhook_url, userId: user_id, lastCheckedBlock: await getLatestBlock(), detectedCount: 0 }; ``` ### Technical Analysis The application performs an outbound HTTPS request to a hostname derived from untrusted `webhook_url`. It does not enforce an approved destination list, reject loopback/private/link-local/reserved addresses, protect against DNS rebinding, or apply outbound network policy. Although th ...[truncated 1272 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: deploy.sh:29
Finding: Unpinned Global Installation and Execution of a Third-Party CLI
Content: View full analysis
/dev/null; then echo "⚠️ ClawHub CLI 未安装" echo "📦 正在安装..." npm install -g @clawhub/cli fi echo "✅ ClawHub CLI 已就绪" ``` The installed executable is subsequently invoked: ```sh # 发布 Skill echo "🚀 正在发布..." clawhub publish . ``` ### Technical Analysis The script installs the latest registry version of `@clawhub/cli` globally without an exact version, lockfile, integrity digest, or provenance verification. Package installation can execute lifecycle scripts, and global installation expands the modification scope beyond the project. If the package, maintainer account, registry resolution, or a future release is compromised, running `deploy.sh` can execute altered code with the privileges of the invoking user. ### Attack Path 1. An attacker compromises the package publication channel or a future package release. 2. A user runs `deploy.sh` on a system without the `clawhub` command. 3. npm resolves and installs the current compromised version globally. 4. Malicious lifecycle or CLI code executes with the user's privileges. 5. The installed command can access files and credentials available to that user and can alter publishing behavior. ### Impact Assessment Impact may include arbitrary code execution with the deployment user's privileges, credential theft from the deployment environment, globally modified tooling, and publication of unintended content. The script itself does not prove that the current dependency is malicious; the confirmed issue is unsafe, unpinned installation. ]]>
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: auto-deploy.js:117
Finding: Deployment Script Uploads an Unverified Archive from Outside the Project
Content: View full analysis
Remediation: View remediation

other

Error

Location: SKILL.md:147
Finding: Advertised Token Safety and Filtering Controls Are Not Implemented
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (66)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The delivery report contains a concrete SkillPay API key in plaintext, which is a sensitive credential and should never be embedded in documentation. Anyone with access to this file could reuse the key to create fraudulent charges, access payment functionality, or abuse the associated account, and the skill's monitoring purpose does not justify exposing a secret at all.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This markdown publicly exposes a live-looking SkillPay API key without any warning, redaction, or safe handling guidance, increasing the likelihood that downstream users will copy, commit, or misuse it. In practice this is another manifestation of secret leakage, and because it relates to payment infrastructure it can directly enable financial abuse or service compromise.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The deployment guide directly exposes a plaintext email/password pair and instructs users to use them to access a third-party service, plus references downloading a server-hosted artifact from /root/.openclaw/workspace. This creates immediate credential compromise risk, unauthorized account access, and potential leakage of privileged server files if the document is shared or published.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Publishing a live-looking API key in an installation guide is a direct secret disclosure. Even if the key is intended for testing, readers have no warning that it is sensitive, and exposed credentials are commonly harvested automatically from public content for unauthorized API usage and account abuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The README includes a live-looking secret key (sk_...) in a configuration example, which is a genuine credential exposure risk. Even if it was intended as sample data, publishing realistic secrets in documentation can enable unauthorized use of the payment service, billing abuse, or compromise of linked accounts; in a paid monitoring skill, that context makes the exposure more dangerous because the key likely grants access to payment operations.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The file contains plaintext login credentials and explicit instructions to use them to access an external service. This is dangerous because anyone with access to the skill files can reuse the credentials, take over the associated account, upload malicious content, or access private deployment data.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The document not only exposes account credentials but instructs the operator to log in with them, which facilitates credential misuse and unauthorized account access. In deployment context, this is especially risky because the account may control publication, billing, or update rights for the skill.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The summary embeds a live-looking SkillPay API key directly in documentation. Hardcoded secrets in distributable files can be harvested by anyone with repository or package access, enabling unauthorized API use, fraudulent billing actions, or abuse of the linked payment account.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Publishing a secret API credential without any handling guidance is dangerous because it normalizes insecure secret management and exposes the token for immediate misuse. In a payment context, exposed credentials can lead to unauthorized payment operations, account abuse, and financial or reputational damage.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The file appears to function more as packaging/deployment/payment metadata than as a trustworthy specification for a live wallet-monitoring system, while still presenting itself as a security-aware monitoring tool. That mismatch is dangerous because it can induce users to rely on nonexistent monitoring, notification, or safety mechanisms in a fast-moving crypto environment.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The file appears to function more as packaging/deployment/payment metadata than as a trustworthy specification for a live wallet-monitoring system, while still presenting itself as a security-aware monitoring tool. That mismatch is dangerous because it can induce users to rely on nonexistent monitoring, notification, or safety mechanisms in a fast-moving crypto environment.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The file appears to function more as packaging/deployment/payment metadata than as a trustworthy specification for a live wallet-monitoring system, while still presenting itself as a security-aware monitoring tool. That mismatch is dangerous because it can induce users to rely on nonexistent monitoring, notification, or safety mechanisms in a fast-moving crypto environment.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The file appears to function more as packaging/deployment/payment metadata than as a trustworthy specification for a live wallet-monitoring system, while still presenting itself as a security-aware monitoring tool. That mismatch is dangerous because it can induce users to rely on nonexistent monitoring, notification, or safety mechanisms in a fast-moving crypto environment.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The file appears to function more as packaging/deployment/payment metadata than as a trustworthy specification for a live wallet-monitoring system, while still presenting itself as a security-aware monitoring tool. That mismatch is dangerous because it can induce users to rely on nonexistent monitoring, notification, or safety mechanisms in a fast-moving crypto environment.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The file appears to function more as packaging/deployment/payment metadata than as a trustworthy specification for a live wallet-monitoring system, while still presenting itself as a security-aware monitoring tool. That mismatch is dangerous because it can induce users to rely on nonexistent monitoring, notification, or safety mechanisms in a fast-moving crypto environment.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script contains hardcoded login credentials and couples them with remote publishing capability, allowing immediate authenticated actions against the external platform. Hardcoded secrets are routinely leaked through source control, logs, archives, or downstream redistribution, enabling account takeover and unauthorized publishing if the code is exposed.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The code reads embedded credentials and transmits them to a remote login endpoint without any runtime warning, consent, or interactive confirmation. This is dangerous because users inspecting or executing auxiliary project scripts may unknowingly disclose valid credentials or trigger authenticated activity, and the plaintext secret exposure itself enables credential theft.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This file implements automated login and remote marketplace upload/deployment behavior that is unrelated to the advertised end-user wallet-monitoring purpose. In skill ecosystems, hidden publisher-side deployment automation increases supply-chain risk because anyone obtaining or running the repository may unintentionally transmit credentials, establish sessions, and publish artifacts to a third-party service.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code parses ERC-20 transfer calldata and then treats the recipient address from the transfer method as the token contract address, falling back to tx.to only otherwise. For token transfers, the actual token contract is typically tx.to, while the parsed recipient is the transfer target wallet; this confusion corrupts token identification, DEV attribution, and any downstream logging or billing decisions.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code records detections as 'charged: true' with a billing amount even though the monitoring path never verifies payment or performs a charge. This can create fraudulent or misleading billing records, enabling overbilling disputes, false accounting, and trust abuse in any downstream system that relies on these fields.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script hardcodes a payment/API credential (api_key) and then includes it in a generated publish URL, which exposes the secret in source control, terminal output, browser history, logs, and any systems that capture URLs. This is unrelated to the wallet-monitoring function of the skill, so the embedded secret materially increases risk without operational necessity.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The file consistently presents the skill documentation in Chinese, including headings, instructions, and usage guidance, without indicating that the user can choose another language. The policy requires flagging language or locale constraints when a specific language is effectively forced without user opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The guide explicitly tells users to copy login credentials back to the server and also demonstrates token-based authentication without any warning about secure handling, storage, masking, or least-privilege use. In a deployment guide, this can normalize unsafe credential practices and increase the likelihood of token exposure through shell history, logs, screenshots, clipboard leakage, or multi-user server access.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · DEPLOY-GUIDE.md (reported line 87)May include surrounding context.
md
zip -r bsc-dev-monitor-skill.zip bsc-dev-monitor-skill/ # 2. 上传到服务器 curl -X POST https://api.clawhub.com/v1/skills \ -H "Authorization: Bearer YOUR_API_TOKEN" \ -F "file=@bsc-dev-monitor-skill.zip" \ -F "name=bsc-dev-monitor" \

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file contains user-facing operational instructions only in Chinese, which can amount to a language/locale policy issue when no opt-in or alternative language is provided. The content does not indicate that the skill is region-specific or that Chinese is a required locale for compliance or audience constraints.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: auto-deploy.js:77

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: index-enhanced.js:13

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: index-updated.js:16

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: index.js:17

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: mock-deploy.js:18

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: README.md:72

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:12