T09 · Insecure Skill Coding Practices
Error
- Location
scripts/trustin_api.py:177- Finding
API Failures Can Be Misclassified as Successful Empty Screenings
- Content
View full analysis
- Remediation
View remediation
Security audit
AMLClaw
Security checks for vulnerabilities and agentic risk
Overview
This AML screening skill is mostly purpose-aligned, but it needs Review because it mishandles API keys, stores sensitive screening data without controls, and can treat failed API screenings as successful.
Review before installing in production. Use it only in a private workspace, avoid passing production API keys on the command line, assume screened addresses and graph data may be sent to TrustIn and saved locally, and manually treat API errors or missing graph data as inconclusive rather than clean results. Pin dependencies and add data retention/access controls before regulated use.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/trustin_api.py:42- Finding
API Credentials Are Exposed Through Query Strings and Command-Line Arguments
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/fetch_graph.py:104- Finding
Unmasked AML Graph Data Is Persisted Without Explicit Access or Retention Controls
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
requirements.txt:1- Finding
Open-Ended Dependency Versions Prevent Reproducible and Verified Installation
- Content
View full analysis
=2.28.0 python-dotenv>=0.19.0 ``` The quick-start instructions also install unpinned packages directly: ```bash # SKILL.md:15 pip install requests python-dotenv ``` ### Technical Analysis The use of minimum-only constraints allows installation to resolve any future version of the two packages. There is no lockfile, upper version boundary, or package hash verification. This does not establish that either current dependency is malicious. However, it means the reviewed source does not uniquely define what code will be installed in the future. Builds may silently change, become incompatible, or consume a compromised upstream release. Because imported Python packages execute with the privileges of the invoking agent or user, dependency integrity is part of the Skill's security boundary. ### Attack Path 1. A user installs the Skill at a later time using the documented command. 2. Package resolution selects versions newer than those reviewed during this audit. 3. A selected release is compromised, malicious, or unexpectedly incompatible. 4. Package installation or import executes the affected dependency with the user's privileges. 5. The dependency can access files, environment variables, and network resources available to the Python process. This is a supply-chain hardening weakness rather than evidence of a presently malicious package. ### Impact Assessment If an upstream package were compromised, code would run with the same privileges as the user or agent that installs and invokes the Skill. Potential scope could include: - Reading environment variables, including `TRUSTIN_API_KEY`. - Reading or modifying files available to the user. - Accessing persisted AML graph and report data. - Making ...[truncated 213 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (53)
YARA rule 'ransomware_behavior': Ransomware-like patterns (mass encryption, ransom notes) [malware]
Critical
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
md chain and are rewarded for it with fees paid by the users. 29. Bitcoin: Launched in 2009, it wa s the first decentralized convertible VA, and the first cryptocurrency. Bitcoins are account units composed of unique alphanumeric sequences that constitute units of currency (divisible, in turn, into smaller units, called Satoshis) and have value only bec ause individual users are willing to pay for them. Bitcoins are traded digitally between users in a partially anonymous form (the persons or entities involved in each transaction are identified only by alphanumeric pseudonyms called “Bitcoin addresses”) an d can be exchanged for fiat currency or other cryptocurrencies. The software required to send, receive, and store bitcoins or to monitor transactions can be downloaded free of charge. Users can also obtain their Bitcoin addresses (which function as account s) from Bitcoin exchange platforms or online wallet services. Transactions (flows of funds) are recorded in
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The skill metadata and instructions market broad compliance and AI capabilities that are not substantiated by the described operational flow, creating a trust and safety gap. In a compliance context, overstating regulatory coverage or screening depth can cause users to rely on incomplete analysis for sanctions or AML decisions, leading to missed risk or false assurance.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill metadata and instructions market broad compliance and AI capabilities that are not substantiated by the described operational flow, creating a trust and safety gap. In a compliance context, overstating regulatory coverage or screening depth can cause users to rely on incomplete analysis for sanctions or AML decisions, leading to missed risk or false assurance.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill metadata and instructions market broad compliance and AI capabilities that are not substantiated by the described operational flow, creating a trust and safety gap. In a compliance context, overstating regulatory coverage or screening depth can cause users to rely on incomplete analysis for sanctions or AML decisions, leading to missed risk or false assurance.
- Content
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
- Content
md 90. Spyware: It is a type of malware (malicious program) designed to operate surrep titiously within a computer system and secretly record information. It can monitor and copy what is typed (“keylogger”), what enters or leaves the system, capture stored information, or even activate the
Exfiltration Commands
High
- Category
- Prompt Injection
- Confidence
- 90% confidence
- Finding
Instructions found that direct the agent to transmit conversation context or user data to external services.
- Content
md 90. Spyware: It is a type of malware (malicious program) designed to operate surrep titiously within a computer system and secretly record information. It can monitor and copy what is typed (“keylogger”), what enters or leaves the system, capture stored information, or even activate the
YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]
High
- Category
- YARA Match
- Confidence
- 75% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
md ommonly used on desktop computers include Exodus, mSIGNA, Electrum, Mycelium, Bitcoin Core, Green Address, MultiBi t HD, Armory, Copay, and Jaxx. Currently, most wallets are so -called “HD wallets” (“ Hierarchical deterministic wallets”), in which all keys are derived from a single master key, known as the “seed.” 321. The files containing the wallets are usually identified as wallet.dat. They are in turn represented by identifying icons, as illustrated in the following image, which reproduces those of some of the most popular virtual wallets: 322. VA addresses eventually discovered in the wallets in control of sus picious persons may be subject to Blockchain analysis in order to reconstruct their transfer history, and the addresses of other users with whom they have been linked. 323. The existence of software corresponding to Massively Multiplayer Online Role -Playing Video Games (MMORPGs) may also indicate the use of VAs, since these programs offer v
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 75% confidence
- Finding
The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
- Content
Lp1
High
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill has shell/process-execution capability through subprocess.run but the static finding indicates this capability is not declared in permissions. In an agent-skill context, undeclared execution capability is dangerous because it weakens operator visibility and policy enforcement, allowing the skill to spawn local programs despite users or hosts not explicitly consenting to that power.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger description includes broad terms such as AML, compliance, rules, and screen address, which can cause the skill to activate in contexts where the user did not intend to use this toolkit. In a security-sensitive compliance domain, unintended invocation can lead to irrelevant file access, external searches, or accidental generation of authoritative-sounding compliance guidance.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The file specifies fuzzy name matching against sanctions lists with a fixed percentage threshold, but does not mention multilingual or locale-aware handling for customer identities. In a policy document that may be applied to diverse customer populations, this can amount to an implicit language/locale constraint without documented opt-in or justification.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The description hard-codes a Hong Kong currency/localization framing by stating amounts as USD with a specific HKD approximation for the trigger, but the file does not explicitly indicate this rule set is only for Hong Kong users or offer any locale choice. This can violate language/locale policy expectations when skills impose a locale-specific interpretation without opt-in or clearly documented regional scoping in the text itself.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This description specifies a USD-to-HKD threshold mapping tied to SFC unhosted wallet rules, which is a locale-specific compliance assumption. Because the text itself does not state that the skill is restricted to Hong Kong jurisdiction or that the user selected this locale, it presents a policy concern under locale enforcement.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The description frames the HKD 8000 Travel Rule limit as the basis for the alert logic, which is a jurisdiction-specific compliance assumption. Without explicit text limiting applicability to Hong Kong-regulated contexts or noting user-selected locale, this is a locale policy issue.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 80% confidence
- Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
- Content
md or transferred and can be used for payment or investment purposes. Virtual assets do not include digital representations of fiat currencies, securities, and > 14 In a VA context, a smart contract is a computer program or a protocol that is designed to automatically execute specific actions such as VA transfer between participants without the direct involvement of a third party when certain conditions are met. 22 UPDATED GUIDANCE: A RISK-BASED APPROACH TO VIRTUAL ASSETS AND VIRTUAL ASSET SERVICE PROVIDERS
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The document gives concrete guidance on deploying spyware and other invasive surveillance capabilities, including covert collection of stored data, credentials, communications, and location information, while only briefly acknowledging privacy concerns later. In a reusable agent skill, presenting such operational detail without prominent user-facing legal, privacy, and civil-liberties guardrails can facilitate misuse or normalize unlawful surveillance.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The file instructs operators to transfer seized virtual assets to state-controlled wallets as soon as possible and provides preparatory steps for doing so. Because cryptocurrency transfers are irreversible and errors can permanently lose funds, the guidance should clearly warn users before these steps begin rather than only mentioning the risk later in execution details.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The opening sentence is written as an instruction/result in Chinese only, indicating the skill output is presented in a fixed language with no visible user opt-in or alternative locale. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless clearly justified as region-specific, which is not documented here.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python fetch_cmd.extend(["--max-timestamp", str(args.max_timestamp)]) try: subprocess.run(fetch_cmd, check=True) except subprocess.CalledProcessError: print("FAILED: API extraction aborted.") sys.exit(1)
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python ] try: result = subprocess.run(extract_cmd, capture_output=True, text=True, check=True) # Parse output from extract_risk_paths.py for line in result.stdout.split('\n'): if line.startswith('{"status": "success"'):
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python class TrustInAPI: """Client for TrustIn API (Async Tasks).""" BASE_URL = "https://api.trustin-webui-dev.com/api/v2/investigate" def __init__(self, api_key: Optional[str] = None): """
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The API key is appended to the URL query string, which is commonly logged by proxies, servers, browser/debug tooling, and observability systems. Even though the transport uses HTTPS, query-parameter secrets are more likely to leak through logs and telemetry, enabling credential compromise and unauthorized use of the external AML service.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The code sends wallet addresses and related investigation parameters to a third-party API via HTTP requests without any user-consent, disclosure, or privacy guard at the call site. In an AML/compliance tool, blockchain addresses may be sensitive operational or customer data, so silent transmission to an external service can create privacy, contractual, and regulatory exposure.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The instruction 'You are an Expert AML Compliance Agent' imposes a fixed role and style for responses without indicating that the user can choose a different language or locale behavior. Under the stated policy, natural-language constraints should not force a specific language or locale unless documented and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 81% confidence
- Finding
The document is explicitly scoped to the Hong Kong SFC regulatory framework, which imposes a locale-specific compliance policy. Under the stated rule, locale constraints should either be clearly justified as region-specific compliance tooling or offer user choice; this file does not explicitly state that it is only for Hong Kong-regulated entities as an operational constraint beyond descriptive scope.
- Content
Static analysis
No suspicious patterns detected.