ClawHub
Back to skill

Security audit

Openclaw Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Buff/Solana round-up investing helper with financial risk, but its network calls, API key use, and unsigned transaction building fit its stated purpose and require user signing.

Install only if you trust Buff and the referenced npm package. Use a scoped, rotatable API key, consider installing with npm lifecycle scripts disabled if compatible, start with small amounts, and independently inspect every unsigned transaction for the expected wallet, treasury, asset, amount, and program before signing.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:41
Finding

Unauditable Third-Party SDK Introduces Supply-Chain Risk

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 41–45
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippet:

markdown
## Quick Start

```bash
npm install buff-protocol-sdk@1.0.1
text

### Technical Analysis

The Skill instructs users to download and install `buff-protocol-sdk@1.0.1` from an external package registry. Although an exact version is specified, the audited project does not include the SDK source code, a dependency lockfile, package integrity hashes, a reviewed dependency tree, or reproducible-build provenance.

Consequently, the audit cannot verify the claim that the dependency is only a thin HTTP client. Package installation may execute npm lifecycle scripts, while the installed package and its transitive dependencies can execute code with the privileges of the invoking user. Such code may also access environment variables declared by the Skill, including the sensitive `BUFF_API_KEY`.

No evidence in the supplied files proves that the named package is currently malicious. The confirmed issue is that execution of an external, unaudited dependency is part of the documented workflow without sufficient integrity controls.

### Attack Path

1. An attacker compromises the published SDK version, its maintainer account, registry delivery path, or a transitive dependency.
2. A user follows the Quick Start instructions and runs `npm install buff-protocol-sdk@1.0.1`.
3. Malicious lifecycle or package code executes in the user's environment.
4. The code reads accessible environment variables or application data, including `BUFF_API_KEY`.
5. During subsequent use, malicious SDK code may exfiltrate credentials, manipulate API parameters, or alter financially sensitive Solana transaction data before it is shown to the user.
6. If the user fails to independently decode and verify every instruction, the user may sign a manipulated transaction.

### Imp
...[truncated 659 chars]
Remediation
View remediation

Remediation Suggestions

  1. Vendor the reviewed SDK source into the project or include it as auditable source code rather than requiring an opaque external installation.
  2. Add a lockfile containing resolved dependency versions and registry integrity hashes.
  3. Publish and verify a cryptographic checksum for the expected SDK package artifact.
  4. Provide signed release provenance and reproducible-build instructions so users can verify that the published package corresponds to reviewed source.
  5. Review and pin every transitive dependency rather than relying only on the top-level SDK version.
  6. Recommend installation with lifecycle scripts disabled where compatible:
    bash
    npm install --ignore-scripts buff-protocol-sdk@1.0.1
  7. Run the client with least privilege and expose only the minimum necessary environment variables.
  8. Make transaction verification mandatory: decode each returned instruction, validate program IDs, destinations, token pairs, and amounts against locally calculated expectations before requesting a signature.
  9. Use scoped, rotatable API keys and document immediate revocation procedures for suspected dependency compromise.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
85% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md
1. **Deserialize the instructions** returned by `/api/wrap` (base64 JSON containing programId, keys, data)
2. **Check that transfers only go to your Buff wallet** (user investment) and the known Buff treasury (`4pWnqVxtSfrMo2XK6AarW3rDNoN7UfAMEyHF8Y9KZGHf`)
3. **Verify amounts match the breakdown** — `userInvestmentLamports` + `buffFeeLamports` should equal `roundUpLamports`
4. **For swaps**, verify the unsigned transaction from `/api/swap/build` contains only Jupiter swap instructions for the expected token pair and amount
5. **Use a scoped/rotatable API key** and test with small amounts first
6. **Compare the breakdown** from `/api/roundup` (informational) with `/api/wrap` (executable) — they should match for the same inputs

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

bash
# Get auth message to sign
curl https://buff.finance/api/auth

# Get plan tiers and config
curl https://buff.finance/api/plans

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

Lines L021-L029 state the SDK contains "zero sensitive logic" and is "just HTTP calls," which implies little or no client-side security-critical responsibility. However, lines L031-L039 assign important validation duties to the client, including checking destinations, program behavior, and amount consistency before signing, which is security-sensitive logic and directly relevant to fund safety.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.