ClawHub
Back to skill

Security audit

Strykr Prism

Security checks for vulnerabilities and agentic risk

Overview

This finance skill is a straightforward PRISM API wrapper, but users should know their symbols, natural-language queries, and wallet addresses may be sent to the PRISM service.

Install only if you are comfortable sending finance queries, asset symbols, contract identifiers, and wallet addresses to the configured PRISM API host. Avoid using it for confidential trading strategy, private portfolio details, or wallet addresses you do not want associated with this provider, and prefer explicit PRISM-related prompts to avoid accidental calls.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (9)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill demonstrates repeated shell-based network access via curl but does not declare any tool scope or allowed-tools boundary. In agent environments, this can lead to the skill being invoked with broader execution capability than users expect, increasing the chance of unintended external calls or misuse of shell access.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Resolve symbol (handles BTC, BTCUSD, XBT, bitcoin, etc.)
curl "$PRISM_URL/resolve/BTC"
curl "$PRISM_URL/resolve/BTCUSDT"
curl "$PRISM_URL/resolve/bitcoin"
Confidence
89% confidence
Finding
The skill is fundamentally designed around transmitting user-supplied symbols and natural-language finance queries to an external API, and the examples begin doing so immediately. While this appears to be the intended function rather than overtly malicious behavior, it is still a real external data transmission risk because user inputs may contain sensitive or proprietary trading interests.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The wallet and on-chain examples encourage sending wallet addresses and contract identifiers to an external service without any privacy notice. Wallet addresses can be sensitive metadata because they enable transaction history correlation, asset profiling, and user deanonymization when transmitted to a third party.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The use-case triggers are phrased very broadly (e.g. common user questions like 'how's the market' or 'what's the price of bitcoin'), which can cause an agent to activate this skill in many ordinary conversations without clear user awareness. That increases the likelihood of unnecessary third-party API calls and data disclosure, especially when paired with shell/network capability.

External Transmission

Medium
Category
Data Exfiltration
Content
curl -s "$PRISM_URL/resolve/$2" | jq .
    ;;
  resolve-nl)
    curl -s -X POST "$PRISM_URL/agent/resolve" \
      -H "Content-Type: application/json" \
      -d "{\"query\": \"$2\"}" | jq .
    ;;
Confidence
96% confidence
Finding
The `resolve-nl` command posts arbitrary user-provided text directly to an external endpoint, creating an external transmission channel for potentially sensitive prompts, trading intent, or proprietary research questions. Because this is an agent skill for financial data, the context makes such leakage more significant: free-form financial queries can reveal positions, strategies, wallet targets, or internal analysis topics.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The script transmits user-supplied free-form input to a remote service in the `resolve-nl` path without any inline warning, consent step, or indication that entered data leaves the local environment. In an agent/tooling context, users may treat symbols, wallet identifiers, or natural-language prompts as routine local inputs, so silent exfiltration of potentially sensitive financial research queries increases privacy and data-handling risk.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger phrase "check {token}" is very broad and can match many ordinary user requests that are not clearly intended to invoke this specific finance skill. In an agent environment, broad triggers can cause unintended activation, expanding the skill's reach and leading to unnecessary transmission of user queries or asset identifiers to an external API.

Vague Triggers

Medium
Confidence
96% confidence
Finding
The trigger "what's trending" is insufficiently scoped and can collide with many general-purpose requests about news, social media, or markets. Because this skill sends requests to a finance API, accidental invocation could cause irrelevant external calls and incorrect agent routing, especially in multi-skill environments.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The phrase "fear and greed" overlaps with common finance discussion and may activate on casual conversation or educational questions, not just requests intended for this API-backed skill. In a financial assistant context, this increases the chance of unintended tool use and silent dependence on an external data provider for ambiguous user input.

Static analysis

No suspicious patterns detected.