ClawHub
Back to skill

Security audit

Crypto Arbitrage Monitor

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent crypto price-alert monitor, but it needs Review because it directs users to put messaging secrets in source code and may expose a Telegram bot token in persistent logs.

Review before installing. The tool appears purpose-aligned, but configure alert secrets through environment variables or a secret manager rather than editing monitor.py, avoid committing source or arb_monitor.log after adding tokens, rotate any token that may have been shared, and prefer pinned dependencies in an isolated virtual environment.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Warning
Location
monitor.py:33
Finding

Messaging credentials are configured directly in source code

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
monitor.py:192
Finding

Telegram bot token may be disclosed through request-error logging

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
requirements.txt:1
Finding

Dependencies are installed without exact version and artifact integrity pinning

Content
View full analysis
=4.0.0 requests>=2.28.0 python-dotenv>=1.0.0 ``` The installation documentation is even less constrained: ```bash pip install ccxt requests python-dotenv ``` ### Technical Analysis The requirements specify only lower version bounds. Consequently, each installation may resolve to any later package release and an evolving set of transitive dependencies. The documentation’s direct `pip install` command imposes no version constraints at all. No lock file or package hashes are provided to ensure that reviewed versions and artifacts are installed. A future compromised release, malicious transitive dependency, unexpected major-version change, or package-index incident could therefore introduce unreviewed code into the application. No evidence of typosquatting, dependency confusion, a malicious package name, or an unsafe package source was found. The risk arises from unconstrained future resolution and lack of reproducible artifact verification rather than from a currently identified malicious dependency. The declared `python-dotenv` dependency is not used by the implementation, unnecessarily increasing the dependency and supply-chain surface. ### Attack Path 1. A user installs the project dependencies using the documented command or current requirements. 2. Package resolution selects the latest versions that satisfy the lower bounds. 3. A selected direct or transitive release is compromised, malicious, or unexpectedly incompatible. 4. Package installation hooks or imported runtime code execute under the privileges of the user running pip or the monitor. 5. The compromised dependency can access data and resources available to that process, including configured messaging credentials and network connectivity. ### Impact Assessment A malicious depe ...[truncated 526 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill description and all user-facing instructions are written in Chinese, with no indication that other languages are supported or that the Chinese-only requirement is optional. Under the policy, language constraints should either be user-selectable or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill documents clear network-capable behavior—polling exchange APIs and sending Feishu/Telegram alerts—but does not declare any tool scope or allowed network permissions. This creates an authorization and review gap: a host may grant broader network access than intended, and users cannot easily verify what outbound connectivity the skill requires.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest description and the body of the skill documentation consistently force a single language/locale for users. Under the policy, this is a natural-language locale restriction unless the skill offers opt-in language selection or clearly justifies being region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The file’s primary natural-language descriptions are in Chinese, including the title and author/context labeling, with no indication that other languages are supported or that Chinese is required for a region-specific purpose. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · monitor.py (reported line 180)May include surrounding context.

python
}
            }
            try:
                requests.post(webhook_url, json=message, timeout=5)
                logger.info(f"✅ 飞书预警发送成功: {opp['symbol']}")
            except Exception as e:
                logger.error(f"❌ 飞书预警发送失败: {e}")

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · monitor.py (reported line 199)May include surrounding context.

python
f"📊 净利润率: *{opp['spread_percent']:.3f}%*\n"
                f"⏰ {opp['timestamp']}"
            )
            url = f"https://api.telegram.org/bot{bot_token}/sendMessage"
            try:
                requests.post(url, json={
                    'chat_id': chat_id,

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · monitor.py (reported line 201)May include surrounding context.

python
)
            url = f"https://api.telegram.org/bot{bot_token}/sendMessage"
            try:
                requests.post(url, json={
                    'chat_id': chat_id,
                    'text': text,
                    'parse_mode': 'Markdown'

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · monitor.py (reported line 50)May include surrounding context.

python
self.exchanges = {}
        for eid in exchange_ids:
            try:
                exchange_class = getattr(ccxt, eid)
                self.exchanges[eid] = exchange_class({
                    'enableRateLimit': True,
                    'timeout': 10000,

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The dependency specification for ccxt uses a lower-bound constraint only, which makes builds non-reproducible and allows future releases to be installed without review. While this is usually a supply-chain hygiene issue rather than an immediately exploitable flaw, in a finance-related monitoring skill it increases exposure to breaking changes or a compromised upstream release.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
ccxt>=4.0.0
requests>=2.28.0
python-dotenv>=1.0.0

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
99% confidence
Finding

The requests dependency is not pinned, so installation may resolve to different versions over time, including versions later found vulnerable or behaviorally incompatible. Because this skill likely makes outbound network requests for exchange and alerting integrations, dependency drift in a core HTTP library is a meaningful supply-chain risk.

Content

Scanner excerpt · requirements.txt (reported line 2)May include surrounding context.

text
ccxt>=4.0.0
requests>=2.28.0
python-dotenv>=1.0.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The manifest includes requests without pinning a version, and requests has multiple known advisories across its release history. Because the installed version cannot be determined from this file, there is a real risk that deployment could pull an affected release, which is more concerning here since the skill likely performs network communication with exchanges and notification services.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
98% confidence
Finding

python-dotenv is also specified with only a minimum version, which prevents reproducible builds and leaves the deployed version uncertain. In a skill that likely handles API keys and bot tokens via environment files, dependency uncertainty around configuration-loading code can increase operational and security risk.

Content

Scanner excerpt · requirements.txt (reported line 3)May include surrounding context.

text
ccxt>=4.0.0
requests>=2.28.0
python-dotenv>=1.0.0

Unverifiable Dependency: python-dotenv has 2 known advisory(ies) (CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
89% confidence
Finding

python-dotenv has known advisories, and the lack of version pinning makes it impossible to verify whether the deployed version is safe. Given that this skill likely relies on .env files for secrets such as exchange credentials or webhook tokens, a vulnerable configuration library could have direct impact on sensitive files or secrets handling.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.