ClawHub
Back to skill

Security audit

NexusWeb3 Financial Infrastructure

Security checks for vulnerabilities and agentic risk

Overview

This skill is not deceptive, but it gives an agent live mainnet financial authority using wallet keys and transaction examples without enough explicit user-control warnings.

Review carefully before installing. Use only a dedicated low-balance wallet or tightly limited operator key, never a primary wallet key, and require explicit confirmation for every mainnet transaction, approval, recipient, amount, contract, and fee.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (5)

Missing User Warnings

High
Confidence
97% confidence
Finding
The quick-start section encourages immediate on-chain use but does not prominently warn that these example calls can spend USDC, incur gas, create irreversible transactions, or lock funds in contracts. In a skill intended for AI agents, missing up-front transactional-risk warnings materially raises the chance of silent or mistaken asset movement.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The README instructs users to provide an `ETH_PRIVATE_KEY` and fund the wallet for live Base mainnet transactions, but it does not warn about key custody, irreversible on-chain actions, hot-wallet exposure, or the financial risk of granting an agent direct signing capability. In an agent skill context, this omission is more dangerous because operators may paste a production private key into automation without understanding that the agent can initiate real-value transactions on mainnet.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The skill is user-invocable and describes itself as a complete financial stack, which is broad enough to match many generic finance-related prompts. In an agent environment, this can cause accidental invocation in contexts where the user did not intend to authorize on-chain or fund-moving actions, increasing the chance of unintended transactions.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill recommends storing an operator private key in an environment variable without an explicit warning that this is still sensitive key material whose compromise can authorize real on-chain spending. Even with spending limits, a leaked operator key can be abused up to its allowance and may be exfiltrated by other tooling, logs, prompts, or misconfigured environments.

External Transmission

Medium
Category
Data Exfiltration
Content
```solidity
AgentMarket.listService(
    "Real-time ETH price feed",   // service name
    "https://api.myagent.com/eth", // endpoint
    5_000_000,                     // $5 USDC per call
    0                              // category: 0=DATA, 1=SECURITY, 2=TRADING, 3=ANALYTICS, 4=GENERAL
)
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.