Clawdit-lender

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:13 PM UTC
• Version: 1.0.0

Overview

The skill is transparent about being an autonomous crypto-lending agent, but it gives the agent recurring wallet-transaction authority without enough user confirmation or secret-handling boundaries.

Review this carefully before installing. Only use it with funds you are prepared to risk, do not place agentCode in ordinary chat or memory, require manual approval before each disbursement or collection, and avoid enabling the cron workflow unless it has clear caps, expiry, logging, and an easy removal path.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

• Location: skill.md:409

Finding

Persistent Scheduled Execution of Autonomous Financial Transactions

Content

View full analysis

Vulnerability Details

File Location: skill.md, lines 409-437
Vulnerability Type: T06: System Persistence
Risk Level: High

Vulnerable Code

text

### Loop timing

This is the time in minutes that you will spin up for every loop and handle all operations.
The recommended time is 60 minutes, this will be key in orchestrating operations.
Setup a cron job for every 60 minutes that runs the ochestration.

### Workflow

The first and most Important thing in the workflow after registration and funding is the **lending decision**.
The lending decision starts with **checking requests** which is the followed by **fetching agent Info** and finally the **decison making**.
After a decision is made you need to **disburse the loan**.
After a loan has been disbursed you are to **periodically check for repayment** and **collect repayments**.
You are to also periodically fetch your **loan history** to keep track of everything.

| Step                      | Endpoint                                             | Method | Guide                                                |
| ------------------------- | ---------------------------------------------------- | ------ |----------------------------------------------------- |
| Check Requests            | `/getRequests?address`                               | GET    | [Checking requests](#checking-requests)              |
| Fetch Agent Info          | `/agentInfo?agentId`                                 | GET    | [Fetching Agent Info](#Fetching-Agent-Info)          |
| Disburse Loan             | `/dispense?agentId&address` agent-passkey: agentCode | POST   | [Disbursing loans](#Disbursing-loans)                |
| Check Due Loans           | `/getLoans/default?address`                          | GET    | [Fetching due loans](#Fetching-due-loans)            |
| Collect Repayment         | `/collect?agentId&address` agent-passkey: agentCode  | POST   | [Collect Paymen
...[truncated 2488 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the instruction to install a cron job or any other persistent scheduler.
2. Run the workflow only in an operator-initiated session by default.
3. Require explicit, transaction-specific operator confirmation before every loan disbursement or repayment collection.
4. If scheduling is an essential opt-in feature, use a visible and readily revocable scheduler with:
   • A fixed expiration time.
   • A documented removal procedure.
   • A disabled-by-default configuration.
   • A strict cumulative spending cap.
   • A maximum transaction amount.
   • An allowlist of permitted operations and destinations.
   • Alerts and immutable audit records for every attempted transaction.
5. Separate analysis from execution so the scheduled component can produce recommendations but cannot transfer funds.
6. Use short-lived, narrowly scoped authorization tokens rather than a credential that authorizes all transaction operations.
7. Stop execution safely when remote responses are malformed, borrower information cannot be independently verified, or operator-defined limits would be exceeded.

T09 · Insecure Skill Coding Practices

Error

• Location: skill.md:113

Finding

Transaction Credential Stored in Unspecified Agent Memory

Content

View full analysis

Vulnerability Details

File Location: skill.md, lines 113-120
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: High

Vulnerable Code

text

**Important:** The `agentCode` is shown **only once**. Store it securely. Store the wallet address as well.
- it's required for almost all agent wallet operations.

### After Registration

**CRITICAL**: Store these values securely in your memory:

- `data.agentCode`: Your agent-specific smart account code for ALL transaction operations (ONE-TIME DISPLAY)
- `data.address`: Your EVM wallet address

Technical Analysis

The Skill directs the Agent to retain a one-time agentCode in unspecified Agent memory. The same document identifies this value as the passkey used for authenticated loan disbursement and repayment collection. It therefore functions as a sensitive transaction credential rather than ordinary workflow state.

Agent conversation memory or generic long-term memory is not an appropriate secret store. Such memory may be incorporated into later model context, retained in platform logs, exposed through debugging or export functions, or disclosed when subsequent untrusted instructions induce the Agent to reveal remembered values. The Skill defines no encryption, access controls, redaction policy, rotation mechanism, expiration, or recovery procedure.

Although sending the passkey to the documented HTTPS API is necessary for the described API design, retaining it in broadly accessible Agent memory is not necessary. The credential should be isolated from model-visible state and retrieved only by a narrowly scoped transaction mechanism.

Attack Path

1. The Agent registers with the remote service and receives the one-time agentCode.
2. Following the Skill instructions, the Agent stores the credential in its memory.
3. The credential persists in model-accessible state, logs, or another storage facility without defined secret pr ...[truncated 1132 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not store agentCode in conversation history, generic Agent memory, prompts, generated files, or logs.
2. Place the credential in an operating-system-backed secret manager or equivalent protected credential vault.
3. Ensure the model receives only an opaque secret reference; a trusted transaction tool should resolve and inject the credential directly into the HTTPS request.
4. Redact the credential from command output, traces, exceptions, telemetry, and debugging data.
5. Replace the broad credential with short-lived, operation-specific authorization tokens.
6. Enforce transaction amount limits, destination restrictions, expiration, replay protection, and operator approval on the server side.
7. Provide credential rotation and immediate revocation procedures.
8. Require reauthentication for consequential operations rather than allowing indefinite reuse of a one-time credential.
9. Document the wallet custody model and verify that possession of the API credential cannot independently bypass wallet-level authorization.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill describes autonomous loan selection, disbursement, and repayment collection involving USDT and wallet-controlled actions without prominent warnings or mandatory user confirmation before irreversible financial operations. In this context, mistakes, manipulation of request data, or flawed risk analysis can directly cause loss of funds or abusive collection behavior.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill tells the agent to store a one-time transaction credential (agentCode) in memory for future wallet operations. Persisting reusable transaction credentials inside agent memory materially increases the risk of credential leakage through logs, memory inspection, prompt injection, or downstream tool exposure, enabling unauthorized wallet actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Although the skill says to store the one-time credential securely, it does not clearly warn that the credential grants sensitive wallet-operation capability and must never be exposed in outputs, logs, or normal conversation context. That omission makes accidental disclosure more likely, particularly in an agent that is instructed to operate autonomously across multiple steps and endpoints.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly directs the agent to set up a cron job for recurring autonomous execution of a financial workflow. Persistent unattended execution increases the chance of repeated unauthorized or unsafe loan disbursements, repayment collection attempts, or misuse after prompt injection or misconfiguration, especially because the actions involve wallet operations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.