ClawHub
Back to skill

Security audit

Fia Signals

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed crypto market-data helper that calls an external Fía Signals API, with some payment and activation-scope documentation gaps users should notice.

Install only if you are comfortable sending crypto symbols and requested market-data actions to x402.fiasignals.com. Treat non-preview endpoints as potentially paid despite SKILL.md's free-preview table, and avoid letting an agent invoke paid market-data calls without an explicit spending gate.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (5)

External Script Fetching

High
Category
Supply Chain
Content
preview|info)
        echo "=== Fía Signals — Free Preview ==="
        curl -s "${API_BASE}/preview" | python3 -c "
import json, sys
d = json.load(sys.stdin)
r = d.get('preview', {}).get('regime', {})
Confidence
90% confidence
Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The README shows commands for invoking paid x402 endpoints and lists prices, but it does not clearly warn that running those commands may trigger a real payment flow or on-chain transaction authorization. In an agent-skill context, users or autonomous agents may execute example commands directly, so insufficient disclosure can lead to unintended spending and unsafe automation behavior.

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill advertises shell and network-capable behavior but does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization ambiguity where an agent may invoke the skill with broader capabilities than users expect, increasing the chance of unintended command execution or external data access.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger description is very broad and overlaps with common market-analysis requests, which can cause the skill to auto-match in many normal conversations. Over-broad activation increases the risk of unnecessary external calls and unintended use of a third-party skill in contexts where the user did not explicitly request it.

Missing User Warnings

Low
Confidence
89% confidence
Finding
The markdown describes real-time market intelligence but does not clearly warn that fulfilling requests sends data to an external third-party API. This is a transparency and privacy issue because users may not realize their prompts or requested symbols are being shared outside the local environment.

Static analysis

No suspicious patterns detected.