ClawHub
Back to skill

Security audit

Claw Trader Lite

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly read-only market monitoring, but it should be reviewed because it promotes an unaudited Telegram trading upgrade outside its disclosed read-only scope.

Use this only for read-only price, balance, and position monitoring. Do not send seed phrases, private keys, API keys, wallet approvals, or funds to the Telegram bot advertised by the script unless that separate trading service is independently verified and audited.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Note
Location
SKILL.md:103
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:103
Vulnerability Type: Uncontrolled third-party dependency version
Risk Level: Low

Vulnerable Code

bash
pip install requests

Technical Analysis

The installation instructions install requests without a fixed version or integrity hash. Consequently, the package resolved at installation time may differ from the version reviewed and tested by the Skill author.

The package name is legitimate, and the audit found no evidence of dependency confusion or an intentionally malicious package. Nevertheless, an unpinned dependency creates supply-chain exposure if the upstream project, package registry, configured package index, or dependency resolution process is compromised. Because claw_lite.py imports requests, malicious code introduced into the resolved package could execute when the Skill starts.

Attack Path

  1. An attacker compromises the upstream package, package registry, or package index used by the target environment.
  2. The attacker publishes or serves a malicious version that satisfies the unrestricted installation command.
  3. A user follows the documented pip install requests instruction.
  4. The uncontrolled package version is installed.
  5. The user starts claw_lite.py, which imports requests.
  6. Malicious package initialization code executes with the privileges of the user running the Skill.

Impact Assessment

Successful exploitation could permit arbitrary Python code execution under the account running the installation or Skill. That code could access files, environment variables, and network resources available to that account. The issue does not itself provide privilege escalation beyond the invoking user's permissions, and exploitation depends on compromise or manipulation of the dependency supply chain.

Remediation
View remediation

Remediation Suggestions

  • Pin requests to a reviewed, compatible version rather than resolving the latest available release.
  • Store dependencies in a dedicated requirements or lock file.
  • Use hash verification, such as pip install --require-hashes -r requirements.txt.
  • Review and update pinned versions regularly to incorporate security fixes.
  • Configure trusted package indexes explicitly in controlled deployment environments.
  • Generate and retain a software bill of materials for released Skill versions.

other

Note
Location
claw_lite.py:133
Finding

Unrelated External Financial-Service Solicitation

Content
View full analysis

Vulnerability Details

File Location: claw_lite.py:133-134
Vulnerability Type: Unsolicited redirection to an unaudited external financial service
Risk Level: Low

Vulnerable Code

python
print("\n⚠️ For live execution, upgrade to Claw Pro")
print("   Message @Opennnclawww_bot with 'buy'")

Technical Analysis

The declared functionality is read-only market and portfolio monitoring. These statements direct users to an external Telegram bot for live trade execution, which is outside that read-only scope and outside the code audited in this project.

The code does not automatically contact the bot, execute trades, transmit credentials, or alter the Agent's instructions. The audit also found no evidence establishing that the named bot is malicious. The risk arises from transferring user trust from an audited, read-only utility to an unaudited external financial workflow without documenting ownership, authentication, permissions, data handling, or transaction safeguards.

Attack Path

  1. A user directly executes claw_lite.py.
  2. The program presents the external bot as the route for upgrading to live execution.
  3. The user contacts @Opennnclawww_bot and sends the instructed message.
  4. The user leaves the audited read-only security boundary.
  5. If the external service requests credentials, wallet authorization, funds, or trade approval, the user may grant access without security assurances from this project.
  6. Any subsequent financial or credential harm would depend on the behavior of that external service, which is not included in the audited repository.

Impact Assessment

No local system privileges are obtained through these lines alone. Potential downstream impact includes exposure to social engineering, unauthorized trading, credential disclosure, wallet authorization, or financial loss if a user trusts an unsafe or impersonated external service. Those downstream behaviors were no ...[truncated 88 chars]

Remediation
View remediation

Remediation Suggestions

  • Remove the solicitation from the executable module because live trading is outside the Skill's declared read-only functionality.
  • If an upgrade path is necessary, place it in clearly labeled documentation rather than runtime output.
  • Disclose the service owner, verified destination, security boundary, fees, permissions, and data-handling practices.
  • Warn users never to provide private keys or seed phrases.
  • Require explicit confirmation before directing users to any external financial service.
  • Independently audit any linked trading integration before presenting it as a trusted continuation of this Skill.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)

Tainted flow: 'account_address' from os.getenv (line 68, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · claw_lite.py (reported line 58)May include surrounding context.

python
if not account_address:
            raise ValueError("Set HYPERLIQUID_ACCOUNT_ADDRESS to monitor balance")
        
        response = requests.post(
            f"{self.base_url}/info",
            json={"type": "clearinghouseState", "user": account_address},
            timeout=10

Tainted flow: 'account_address' from os.getenv (line 68, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · claw_lite.py (reported line 72)May include surrounding context.

python
if not account_address:
            raise ValueError("Set HYPERLIQUID_ACCOUNT_ADDRESS to monitor balance")
        
        response = requests.post(
            f"{self.base_url}/info",
            json={"type": "clearinghouseState", "user": account_address},
            timeout=10

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 1)May include surrounding context.

md
To create the file yourself:

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md
\# Create the file

cat > ~/.openclaw/workspace/skills/claw-trader-lite/SKILL.md << 'EOF'

---

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · claw_lite.py (reported line 44)May include surrounding context.

python
def get_price(self, coin: str) -> float:
        """Get current mid price"""
        response = requests.post(
            f"{self.base_url}/info",
            json={"type": "allMids"},
            timeout=10

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · claw_lite.py (reported line 58)May include surrounding context.

python
def get_price(self, coin: str) -> float:
        """Get current mid price"""
        response = requests.post(
            f"{self.base_url}/info",
            json={"type": "allMids"},
            timeout=10

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · claw_lite.py (reported line 72)May include surrounding context.

python
def get_price(self, coin: str) -> float:
        """Get current mid price"""
        response = requests.post(
            f"{self.base_url}/info",
            json={"type": "allMids"},
            timeout=10

Static analysis

No suspicious patterns detected.