ClawHub
Back to skill

Security audit

Learn Moralis

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only Moralis onboarding skill with some wording issues, but no hidden code, broad data access, or execution capability.

Installers should understand this as a Moralis documentation and routing skill. Do not paste API keys into chat unless you intentionally want a technical Moralis skill to use them, and add your own safety controls before building any bot that acts on webhook events or trading signals.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The manifest description says the skill is used for broad prompts like "how do I get started" and "any exploratory questions," which overlap with common conversational requests and are not tightly scoped to Moralis unless the router already infers that context. This ambiguity could cause unintended invocation when a user asks a generic onboarding question not specifically about Moralis.

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The manifest states the skill is knowledge-only and does not require or access API keys or environment variables, but the body later instructs users to set `MORALIS_API_KEY` and says the skill will check for it. This inconsistency can mislead users and downstream systems about the skill's trust boundary and capabilities, increasing the risk of secret-handling confusion or unsafe delegation.

Vague Triggers

Medium
Confidence
91% confidence
Finding
The file states the skill responds when the user "just says 'learn moralis'" or invokes it with no question, but it does not clearly define whether similar phrases, partial mentions, or broader learning requests should activate it. Without negative examples or tighter constraints, the activation boundary is unclear.

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The getting-started text says the skill will help create a `.env` file and check for an API key, which contradicts the declared read-only, knowledge-only tool scope. Even without direct secret access, such misleading instructions can cause users or orchestrators to expose credentials under false assumptions about what the skill can do.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The guide includes a 'Trading Bot / Alerts' use case with implementation steps for processing webhooks and executing trading logic, but it does not warn that automated execution can trigger real financial loss, unintended trades, front-running exposure, or cascading actions from malformed or spoofed inputs. In a developer-facing skill, omission of basic safety guidance around bot actions materially increases the chance that users deploy automation without validation, guardrails, rate limits, or human review.

Static analysis

No suspicious patterns detected.