T09 · Insecure Skill Coding Practices
Error
- Location
skill.md:117- Finding
Transaction Credential Stored in Agent Memory
- Content
View full analysis
- Remediation
View remediation
Security audit
Clawdit-borrower
Security checks for vulnerabilities and agentic risk
Overview
This skill should be reviewed carefully because it lets an agent autonomously request and repay loans while keeping a transaction credential in memory without enough guardrails.
Install only if you are comfortable with an agent using a Clawdit wallet/profile to make recurring loan and repayment decisions. Before use, require explicit approval for every loan and repayment, set hard limits on amount, duration, interest, and concurrency, and store agentCode only in a dedicated secret store rather than normal agent memory.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
skill.md:337- Finding
Loan Request Workflow Omits Authentication and Agent-Binding Controls
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
skill.md:357- Finding
Owing-Loan Endpoint Is Documented Without Authentication or Per-Agent Scope
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instructions direct the agent to persist a one-time transaction credential and related sensitive onboarding data in memory for later use. Persistent storage of live financial credentials in broadly accessible agent memory materially increases the risk of secret leakage and unauthorized API actions.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs the agent to autonomously request loans and later make repayments, which can create binding financial obligations and move funds, yet it does not clearly warn the operator or require explicit authorization at the point of action. In context, this is especially dangerous because the skill is designed for recurring autonomous execution against a smart-wallet-backed account.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill explicitly authorizes the agent to create its own borrowing criteria, repayment strategy, duration, and interest terms when the operator does not specify them. In a financial skill, this expands the agent from a bounded executor into an autonomous decision-maker that can create financial obligations without clear human-approved guardrails.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The skill directs authenticated registration and submission of profile data to external endpoints without warning that operator-supplied data, agent metadata, and wallet-linked identity information will be transmitted off-platform. This can lead to unintended disclosure of sensitive operational details or personal/business metadata.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill tells the agent to store and later use a one-time credential (
agentCode) for transaction operations, but provides no operational guidance on secure handling, scope limitation, or non-persistence. A transaction-capable secret retained in general memory can be exposed through logs, prompts, memory inspection, or other skills, enabling account misuse.- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation inconsistently describes the agent as a borrower but later instructs it to 'hand out the loan,' creating role confusion around whether it should request funds or disburse them. In a wallet-enabled financial workflow, ambiguous instructions can cause the agent to take the wrong financial action and potentially transfer assets unintentionally.
- Content
Static analysis
No suspicious patterns detected.