Security audit

Noya Agent Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its crypto-agent purpose, but it under-scopes sharing of private conversation and financial context with Noya and other agents.

Install only if you are comfortable sending crypto prompts and account-linked data to Noya. Before using handoff or delegation workflows, review exactly what conversation context or financial data will be shared, avoid forwarding full summaries, delete any generated user_context.json file, and use a short-lived API key you can revoke.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:137
Finding: Mandatory Disclosure of Prior Conversation Context Without Explicit User Consent
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:589
Finding: Comprehensive Financial Profile Written to Plaintext and Shared With an Unspecified Downstream Agent
Content: View full analysis
user_context.json 2. Pass user_context.json as the system/user context to the downstream agent. → Returns wallet holdings, all DCA strategies, open and closed Polymarket positions in a single JSON object. Partial failures are isolated — the response always returns whatever data is available, with an error field for any source that failed. ``` ``` ### Technical Analysis The workflow retrieves a comprehensive authenticated financial profile and writes it to a predictable plaintext file named `user_context.json`. It then instructs the agent to send the entire file to an unspecified downstream agent. The summary can contain wallet addresses, token and DeFi holdings, net worth values, DCA strategy details, and open and closed prediction-market positions. This is broader than the data required for many delegated tasks. The workflow lacks: - Field-level data minimization. - Explicit user approval for onward disclosure. - Restrictions on eligible downstream recipients. - A secure temporary-file mechanism. - Restrictive file permissions. - Guaranteed cleanup after use. - Redaction of wallet identifiers and financial positions. The file is created under the process's current `umask`; the instructions do not guarantee mode `0600`. It also remains on disk after the delegation workflow ends. A fixed filename can be accidentally reused, included in backups, committed to source control, or read by processes with access to the working directory. ### Attack ...[truncated 1451 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: noya-message.sh:17
Finding: Automatic Collection and Transmission of Local Timezone Metadata
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence

Findings (38)

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill recommends using a complete authenticated user summary—holdings, DCA strategies, and prediction-market positions—as context for another agent. Wholesale transfer of comprehensive financial state to a downstream agent materially increases privacy and security risk if that agent is compromised, logs data, or uses it beyond the original purpose.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The delegation pattern explicitly says to brief another agent on everything about the user, which promotes unrestricted transfer of highly sensitive financial and behavioral data. In the context of a crypto trading skill, that can expose holdings, positions, strategy, and identity-linked preferences to additional systems unnecessarily.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · reference.md (reported line 224)May include surrounding context.
md
--- ## DELETE /api/threads/:threadId Delete a conversation thread.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · reference.md (reported line 477)May include surrounding context.
md
List all API keys for the authenticated user. Returns prefixes only, never full keys. ### DELETE /api/keys/:id Revoke an API key (soft delete).

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill invokes shell commands extensively (curl, jq, uuidgen, python3, open/xdg-open) but declares no explicit tool scope or permissions boundary. That makes the operational capability broader and less auditable than the metadata suggests, increasing the chance of unintended command execution or misuse in environments that rely on declared scopes for policy enforcement.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.
md
To additionally use the conversational agent endpoints (messaging, threads, chat completions, user summary, agent summary): 1. Create an account at [agent.noya.ai](https://agent.noya.ai) 2. Go to Settings > API Keys and generate a key 3. Store the key securely — it is only shown once 4. Set the environment variable:

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly instructs forwarding broad prior conversation context—including schedule, timezone, and investment preferences—to an external service before task execution. This exceeds data minimization needs for many crypto actions and creates unnecessary third-party disclosure of personal information.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The handoff flow encourages transferring broad conversation details to another agent, including schedule and preferences, beyond what is needed for the crypto task. This is a classic excessive data-sharing pattern that expands privacy exposure without clear necessity.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 94% confidence
Finding: This endpoint sends conversation context and personal details to an external service. External transmission itself is expected for this skill, but here the payload is explicitly designed to include broader prior-chat context, making the transmission more privacy-sensitive than necessary.
Content: Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.
For every new chat that OpenClaw initiates with Noya, call this endpoint first to set up the conversation context. This makes the chat with Noya feel like a natural continuation of the user's conversation with OpenClaw, rather than starting fresh.

bash
curl -s -X POST "https://agent-api.noya.ai/api/openclaw/system-message" \ -H "Content-Type: application/json" \ -H "x-api-key: $NOYA_API_KEY" \ -d '{

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The example system-message payload concretely demonstrates forwarding personal details to the downstream service, making oversharing the default implementation path. Example code strongly shapes operator behavior and can institutionalize unnecessary disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill recommends sending non-essential personal context to Noya to make the handoff feel seamless, but does not require a user-facing privacy warning or consent step. Users may not reasonably expect their schedule, timezone, or prior chat details to be transmitted to a third party for this purpose.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: This second documented use of the system-message endpoint repeats the same risky pattern of transmitting handoff context to a third party. The danger is not the network call alone, but the encouragement to populate it with broad user conversation details.
Content: Scanner excerpt · SKILL.md (reported line 281)May include surrounding context.
Injects a system message into a thread before the conversation starts. OpenClaw should call this for every new chat to hand off conversation context to Noya, making the transition feel seamless for the user.

bash
curl -s -X POST "https://agent-api.noya.ai/api/openclaw/system-message" \ -H "Content-Type: application/json" \ -H "x-api-key: $NOYA_API_KEY" \ -d '{

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 326)May include surrounding context.
md
### GeckoTerminal (on-chain DEX data) | Tool | Method | Path | Body | | ---------------------- | ------ | ------------------------------- | ------------------------------------------------------------------------------------------------------------------- | | Token pools | POST | `/geckoterminal/token-pools` | `{ "network": "eth", "tokenAddress": "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2" }` | | Pool OHLCV candles | POST | `/geckoterminal/pool-ohlcv` | `{ "network": "eth", "poolAddress": "0x88e6A0c2dDD26FEEb64F039a2c41296FcB3f5640", "timeframe": "day", "limit": 7 }` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 331)May include surrounding context.
md
| Token pools | POST | `/geckoterminal/token-pools` | `{ "network": "eth", "tokenAddress": "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2" }` | | Pool OHLCV candles | POST | `/geckoterminal/pool-ohlcv` | `{ "network": "eth", "poolAddress": "0x88e6A0c2dDD26FEEb64F039a2c41296FcB3f5640", "timeframe": "day", "limit": 7 }` | | Pool trades | POST | `/geckoterminal/pool-trades` | `{ "network": "eth", "poolAddress": "0x88e6A0c2dDD26FEEb64F039a2c41296FcB3f5640" }` | | Trending pools | GET | `/geckoterminal/trending-pools` | — | | Token info + top pools | POST | `/geckoterminal/token-info` | `{ "network": "eth", "addresses": ["0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2"] }` | ### CoinGecko

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 336)May include surrounding context.
md
| Token pools | POST | `/geckoterminal/token-pools` | `{ "network": "eth", "tokenAddress": "0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2" }` | | Pool OHLCV candles | POST | `/geckoterminal/pool-ohlcv` | `{ "network": "eth", "poolAddress": "0x88e6A0c2dDD26FEEb64F039a2c41296FcB3f5640", "timeframe": "day", "limit": 7 }` | | Pool trades | POST | `/geckoterminal/pool-trades` | `{ "network": "eth", "poolAddress": "0x88e6A0c2dDD26FEEb64F039a2c41296FcB3f5640" }` | | Trending pools | GET | `/geckoterminal/trending-pools` | — | | Token info + top pools | POST | `/geckoterminal/token-info` | `{ "network": "eth", "addresses": ["0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2"] }` | ### CoinGecko

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 340)May include surrounding context.
md
| ---------------------- | ------ | -------------------------- | ---------------------------------------------------------------------------------------------------------------------- | | Batch spot prices | POST | `/coingecko/price` | `{ "tokenIds": ["bitcoin","ethereum"], "vsCurrencies": ["usd"], "include24hrChange": true, "includeMarketCap": true }` | | OHLCV candles | POST | `/coingecko/ohlcv` | `{ "tokenId": "bitcoin", "vsCurrency": "usd", "days": "7", "interval": "daily" }` | | Token info / contracts | POST | `/coingecko/token-info` | `{ "tokenId": "ethereum" }` | | Trending tokens | GET | `/coingecko/trending` | — | | Search by name/symbol | POST | `/coingecko/search` | `{ "query": "eth" }` | | Price history | POST | `/coingecko/price-history` | `{ "tokenId": "bitcoin", "days": "30" }` or `{ "tokenId": "bitcoin", "from": "2026-01-01", "to": "2026-02-01" }` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 341)May include surrounding context.
md
| Batch spot prices | POST | `/coingecko/price` | `{ "tokenIds": ["bitcoin","ethereum"], "vsCurrencies": ["usd"], "include24hrChange": true, "includeMarketCap": true }` | | OHLCV candles | POST | `/coingecko/ohlcv` | `{ "tokenId": "bitcoin", "vsCurrency": "usd", "days": "7", "interval": "daily" }` | | Token info / contracts | POST | `/coingecko/token-info` | `{ "tokenId": "ethereum" }` | | Trending tokens | GET | `/coingecko/trending` | — | | Search by name/symbol | POST | `/coingecko/search` | `{ "query": "eth" }` | | Price history | POST | `/coingecko/price-history` | `{ "tokenId": "bitcoin", "days": "30" }` or `{ "tokenId": "bitcoin", "from": "2026-01-01", "to": "2026-02-01" }` | | Price at date | POST | `/coingecko/price-at-date` | `{ "tokenId": "bitcoin", "date": "2025-12-31" }` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 342)May include surrounding context.
md
| OHLCV candles | POST | `/coingecko/ohlcv` | `{ "tokenId": "bitcoin", "vsCurrency": "usd", "days": "7", "interval": "daily" }` | | Token info / contracts | POST | `/coingecko/token-info` | `{ "tokenId": "ethereum" }` | | Trending tokens | GET | `/coingecko/trending` | — | | Search by name/symbol | POST | `/coingecko/search` | `{ "query": "eth" }` | | Price history | POST | `/coingecko/price-history` | `{ "tokenId": "bitcoin", "days": "30" }` or `{ "tokenId": "bitcoin", "from": "2026-01-01", "to": "2026-02-01" }` | | Price at date | POST | `/coingecko/price-at-date` | `{ "tokenId": "bitcoin", "date": "2025-12-31" }` |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 367)May include surrounding context.
md
### CryptoNews | Tool | Method | Path | Body / Query | | ------------------ | ------ | ----------------------- | -------------------------------------------------------------------------------------------- | | News articles | POST | `/cryptonews/news` | `{ "tickers": "BTC,ETH", "items": 10, "sentiment": "positive" }` | | Sentiment analysis | POST | `/cryptonews/sentiment` | `{ "tickers": "BTC,ETH", "date": "last7days" }` (`date` defaults to `last30days` if omitted) |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 463)May include surrounding context.
md
Dispatch up to 20 data endpoints in a single HTTP call. Each sub-request runs in parallel through the same rate limiter and cache as a direct call, so cache entries are shared and partial failures are isolated (one failing item never fails the whole batch). | Tool | Method | Path | Body | | ---------------------------------- | ------ | -------- | ---------------------------------------------------------------------------------------- | | Run multiple endpoints in one call | POST | `/batch` | `{ "requests": [ { "name": "...", "method": "POST", "path": "/...", "body": {...} } ] }` |

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 479)May include surrounding context.
Top-level defaultTimeoutMs (integer, optional) sets the default per-item timeout (default 15000, max 60000). Batch size is capped at 20 items; names must be unique within a batch.

bash
curl -s -X POST "https://data-endpoints.noya.ai/batch" \ -H "Content-Type: application/json" \ -d '{ "requests": [

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 507)May include surrounding context.
Each result is either { ok: true, status, data, cache? } or { ok: false, status, error }. cache is "HIT" or "MISS" when the sub-request went through the cache layer. Use /batch whenever you'd otherwise fire multiple sequential curls to the same base URL — it reduces round-trips without changing per-item semantics.

Calling a data endpoint with curl

bash
# POST with a JSON body (no auth header)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 524)May include surrounding context.
bash
# Fear & Greed curl -s -X POST "https://data-endpoints.noya.ai/alternative/fear-greed" \ -H "Content-Type: application/json" -d '{"limit":7}' | jq

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 621)May include surrounding context.
bash
# Fear & Greed curl -s -X POST "https://data-endpoints.noya.ai/alternative/fear-greed" \ -H "Content-Type: application/json" -d '{"limit":7}' | jq

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 531)May include surrounding context.
If the user provides a plain symbol ("SOL", "ARB"), resolve it to a CoinGecko ID first:

bash
curl -s -X POST "https://data-endpoints.noya.ai/coingecko/search" \ -H "Content-Type: application/json" -d '{"query":"sol"}' | jq '.coins[0].id'

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

SkillSpector

Ssd 3

Ssd 3

Tool Parameter Abuse

Tool Parameter Abuse

Undeclared Tool Scope

Session Persistence

Context-Inappropriate Capability

Ssd 3

External Transmission

Ssd 3

Missing User Warnings

External Transmission

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

Whitespace Padding

External Transmission

External Transmission

Calling a data endpoint with curl

External Transmission

External Transmission

External Transmission

Static analysis