Security audit
Security checks for vulnerabilities and agentic risk
The skill matches its Web3 research purpose, but it makes broad host, browser, API, credential, and persistence changes that users should review before installing.
Install only if you are comfortable with a global browser-automation package being installed, research targets and prompts being sent to the Crab service and upstream providers, and reports plus a generated API credential being stored in your home directory. Prefer running it in a disposable or sandboxed environment, avoid sensitive/private investigation targets, and rotate/delete `~/.config/crab/credentials.json` and `~/.crab-catch/reports` when finished.
REPORT_TEMPLATE.md:1Mandatory Report Template Loads a Mutable External Branding Asset
Crab Catch — Research Assistant
SKILL.md:15Mandatory Unpinned Global npm Package Installation
scripts/crab_auth.js:25Crab Authentication Headers Are Replayable Across Requests for 24 Hours
The skill description does not accurately communicate that it includes authentication/signing flows, local credential storage, and access-control related components. Even if some of this behavior is ancillary, the mismatch can mislead users and operators about trust boundaries and what sensitive actions the skill may take.
The skill description does not accurately communicate that it includes authentication/signing flows, local credential storage, and access-control related components. Even if some of this behavior is ancillary, the mismatch can mislead users and operators about trust boundaries and what sensitive actions the skill may take.
The skill description does not accurately communicate that it includes authentication/signing flows, local credential storage, and access-control related components. Even if some of this behavior is ancillary, the mismatch can mislead users and operators about trust boundaries and what sensitive actions the skill may take.
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
| birdeye.so | `/token/address` | → contract |
| defined.fi | `/chain/address` | → contract + chain |
## Data Display Rules
- Skip any metric that returned an error or timed out — leave it out entirely.
- Do not display API latency unless it was actually measured successfully.
The script generates a wallet keypair, stores the private key in a local credentials file, and reuses cached signed authentication headers for up to 24 hours. In a Web3 research skill, these credentials authenticate API access; if the file or cached headers are exposed through local compromise, backup sync, shared home directories, or logs, an attacker may impersonate the user or reuse valid headers until expiry. The context makes this more sensitive because the skill is specifically designed to automate Web3 data collection and signing, so credential material is part of the normal execution path.
* node skills/scripts/crab-sign.js --refresh # 强制重新生成签名
*
* 流程：
* 1. 首次运行：生成密钥对 + 签名，保存到 ~/.config/crab/credentials.json
* 2. 后续运行：检查已保存的签名是否在 24h 内，有效则直接复用
* 3. 过期或 --refresh：重新签名并保存
*
This module stores a raw private key in a predictable local file (~/.config/crab/credentials.json) and later reloads it, creating a credential-at-rest exposure point. If the local machine, backup set, or developer workspace is compromised, an attacker can steal the private key and forge authenticated API requests as the user.
".config",
"crab",
);
const CREDENTIALS_PATH = path.join(CREDENTIALS_DIR, "credentials.json");
const SIGN_PREFIX = "CRAB-AUTH:";
const TIMESTAMP_TOLERANCE_S = 86400;
The documentation describes address balance and transaction-history endpoints backed by third-party providers (Helius/Alchemy) but does not warn that queried wallet addresses and related activity may be transmitted to those external services. This creates a privacy and transparency issue: users or downstream integrators may unknowingly expose sensitive research targets, wallet interests, or analyst activity patterns to infrastructure providers.
The file title and the entire architectural guidance are written in Chinese, which effectively fixes the skill's operating language/locale. The document does not offer a language choice, user opt-in, or a stated region-specific justification for this locale constraint.
The report template is entirely written in English, including headings, instructions, and the final disclaimer, with no indication that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.
The skill requires shell execution, network access, and likely environment use, but it declares no explicit tool scope or permission boundaries. This weakens least-privilege controls and can cause an agent or user to invoke broader host capabilities than expected, especially because the skill also performs installation, authentication, and local file writes.
The skill mandates installing a global CLI (npm install -g agent-browser) and executing it at session start, which modifies the host environment and expands runtime capabilities. Automatic tool installation increases supply-chain and host-integrity risk, especially when performed before any user confirmation or integrity verification.
Requiring session-start installation without a clear warning about system modification undermines informed consent and safe operation. Users may not realize the skill changes the host, introduces new executables, or pulls untrusted code from the package ecosystem.
The skill routes research activity through an authenticated external API and instructs reuse of signed headers, but it does not clearly warn users that collected project, social, and possibly sensitive investigative data may be transmitted off-box. This creates privacy, confidentiality, and potential credential-misuse concerns.
The skill describes writing outputs into ~/.crab-catch/reports and maintaining an index, but does not give a user-facing warning that files will be created in the home directory. Silent persistence of reports and metadata can surprise users and expose sensitive research topics or user prompts to local disclosure.
The index format explicitly stores the original user input alongside project and date metadata, creating a natural-language data retention trail. User inputs may contain sensitive targets, private hypotheses, wallet addresses, or investigative context that should not be retained by default.
The skill explicitly instructs the agent to open arbitrary external URLs, click elements, fill inputs, capture screenshots, and save PDFs, but it provides no safety guidance about interacting with untrusted sites or writing files locally. In a Web3 research context, these actions can trigger wallet prompts, unintended state-changing flows, phishing interactions, or local data persistence without operator awareness, making the omission materially risky.
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
# 4. Interact
agent-browser click @e1 # click
agent-browser fill @e2 "keyword" # fill input (clears first)
agent-browser scroll down 500 # scroll
agent-browser scrollintoview @e1 # scroll element into view
agent-browser press Enter # press key
Lines L02-L06 define this component as 'github-analysis' for GitHub repository code analysis and Markdown conversion, with no mention of broader Web3 research reporting. While code analysis can support Web3 due diligence, the documented behavior here is a narrow repository inspection tool rather than the complete multi-source research and risk-reporting capability claimed by the manifest context.
The skill explicitly instructs callers to send prompts, tweet URLs, project names, and potentially full OpenAI-style message lists to an external service at crab-skill.opsat.io, but it provides no warning about third-party processing, retention, or privacy implications. Because message lists can contain broader context than intended, this creates a real risk of unnecessary disclosure of sensitive research data, user inputs, or proprietary investigation context to an external LLM-backed API.
The file’s natural-language instructions and status messages are written only in Chinese, which imposes a specific language on users. Under the policy, language restrictions should either offer user choice or be clearly documented as a justified locale-specific tool, which is not present here.
The manifest describes a Web3 research skill that collects and organizes project data from public sources and produces reports. This module instead creates a local cryptographic identity and persists a private key under the user's home directory, which is an authentication capability not obviously required for passive research and reporting.
The manifest frames the skill as a data-collection and risk-reporting tool over social, web, code, and on-chain sources. This code performs wallet/keypair generation, address derivation, and credential file management, which are materially different operational behaviors from research/report generation and are not described as part of the skill's scope.
The function downloads repository files and embeds their contents directly into a generated Markdown document, which can expose sensitive material from public or mistakenly-accessible repositories, including secrets committed in error, internal documentation, or proprietary source. In this Web3 research context, the skill is specifically designed to aggregate and repackage project data, which increases the likelihood of broad downstream sharing of extracted content without the user's awareness.
The skill documentation describes sending Twitter/X query data to an external base URL but does not warn users that usernames, search terms, tweet IDs, and related research inputs will be transmitted off-platform. In a Web3 research context, those inputs may reveal sensitive investigative targets, trading theses, or internal monitoring activity, creating confidentiality and privacy risk even if the endpoint is legitimate.
The skill writes reports and an index into the user's home directory, adding persistent local storage behavior beyond pure analysis. While not inherently malicious, undisclosed or weakly justified persistence can expose sensitive research subjects, inputs, and artifacts to other local processes or users.
No suspicious patterns detected.