ClawHub
Back to skill

Security audit

Tip with Grove

Security checks for vulnerabilities and agentic risk

Overview

This skill is a real Grove tipping guide, but it asks users to install unverified remote code and includes scripts that can move funds or monitor balances with weak safeguards.

Review this carefully before installing. Use only an isolated low-balance wallet, avoid the curl-to-bash installer unless you can verify the installer independently, do not run the auto-fund cron or batch-tip scripts with real funds until limits and validation are fixed, and treat webhook alerts as sharing account balance data with the webhook destination.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:6
Finding

Unpinned Remote Installer Is Downloaded and Executed Directly

Content
View full analysis
Remediation
View remediation
' install-cli.sh | sha256sum -c - less install-cli.sh bash install-cli.sh ``` 5. Sign release artifacts and verify signatures against a public key distributed through an independent trusted channel. 6. Document exactly which files, binaries, and permissions the installer changes. 7. Run installation with ordinary user privileges and do not request administrator access unless a specific operation strictly requires it. 8. Replace the unsafe command in all three script error messages with the verified installation procedure. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
scripts/auto-fund.sh:128
Finding

Unvalidated Financial Values Are Interpreted as bc Programs

Content
View full analysis
/dev/null; then if (( $(echo "$balance < $threshold" | bc -l) )); then return 0 # balance < threshold else return 1 # balance >= threshold fi else balance_cents=$(echo "$balance * 100" | awk '{print int($1)}') threshold_cents=$(echo "$threshold * 100" | awk '{print int($1)}') if [[ $balance_cents -lt $threshold_cents ]]; then return 0 else return 1 fi fi } ``` ```bash new_balance=$(echo "$current_balance + $FUND_AMOUNT" | bc -l) ``` From `scripts/batch-tip.sh`: ```bash if [[ "$line" =~ , ]]; then IFS=',' read -r dest amt <<< "$line" else read -r dest amt <<< "$line" fi dest=$(echo "$dest" | xargs) amt=$(echo "$amt" | xargs) if [[ -z "$dest" ]] || [[ -z "$amt" ]]; then echo -e "${YELLOW}⚠️ Line $line_num: Skipping invalid entry${NC}" continue fi destinations+=("$dest") amounts+=("$amt") ``` ```bash total_amount=0 for amt in "${amounts[@]}"; do total_amount=$(echo "$total_amount + $amt" | bc -l) done if (( $(echo "$total_balance < $total_amount" | bc -l) )); then echo -e "${RED}Error: Insufficient balance${NC}" >&2 echo "Need at least $total_amount USDC, but only have $total_balance USDC" >&2 ex ...[truncated 2734 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/auto-fund.sh:207
Finding

Auto-Fund Maximum Balance Is Not Enforced Before Funding

Content
View full analysis
&1) ``` The script also supports unattended confirmation bypass: ```bash --yes) SKIP_CONFIRM=true shift ;; ``` ### Technical Analysis The script calculates the projected balance and detects when funding would exceed `MAX_BALANCE`, but it only emits a warning. It neither exits nor caps the amount before calling `grove fund`. This is particularly hazardous because the documentation recommends `--yes` for cron usage. In that mode, there is no opportunity for a person to react to the warning. The script also accepts `FUND_AMOUNT` from a command-line argument without a hard upper bound. The existing earlier check only stops funding if the current balance is already at or above the maximum. It does not enforce the maximum against the projected post-funding balance. ### Attack Path 1. The script is configured with a low minimum balance and a fund amount that would place the account above `MAX_BALANCE`. 2. The current balance falls below the minimum, so the auto-funding branch is entered. 3. The script calculates that the projected balance exceeds the maximum. 4. It prints a warning but continues. 5. If run with `--yes`, as recommended for cron, no interactive approval is requested. 6. `grove fund` is called for the full configured amount. ...[truncated 758 chars]
Remediation
View remediation
&2 exit 1 fi ``` 3. Alternatively, calculate and fund only: ```text min(FUND_AMOUNT, MAX_BALANCE - current_balance) ``` 4. Reject zero, negative, malformed, or excessively large funding values. 5. Add a separate hard per-transaction cap that cannot be bypassed by `--yes`. 6. For scheduled use, require an explicit configuration file with restrictive permissions rather than accepting unrestricted cron-supplied values. 7. Record the requested amount, enforced amount, projected balance, network, and transaction result in an audit log. 8. Add tests covering equality, rounding boundaries, projected-limit violations, and very large values. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
scripts/batch-tip.sh:127
Finding

Batch Tipping Does Not Enforce Per-Tip or Aggregate Payment Limits

Content
View full analysis
&2 echo "Need at least $total_amount USDC, but only have $total_balance USDC" >&2 exit 1 fi ``` The script then suppresses the CLI's per-payment confirmation: ```bash for i in "${!destinations[@]}"; do dest="${destinations[$i]}" amt="${amounts[$i]}" progress=$((i + 1)) printf " [%d/%d] Tipping %s → %s USDC... " "$progress" "$total_count" "$dest" "$amt" if grove tip "$dest" "$amt" --network "$NETWORK" --yes > /dev/null 2>&1; then echo -e "${GREEN}✓${NC}" results+=("✓ $dest") success_count=$((success_count + 1)) else echo -e "${RED}✗ Failed${NC}" results+=("✗ $dest") failed_count=$((failed_count + 1)) fi done ``` ### Technical Analysis The script validates whether destinations are tippable, but it does not establish that each amount is: - A valid positive decimal. - Within a safe per-recipient maximum. - Within a safe aggregate batch maximum. - Consistent with a trusted batch manifest. Before execution, the user is shown the total count and comp ...[truncated 1768 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (31)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The content mentions monitoring and automation utilities that operate on live account state, write logs, and potentially trigger notifications, which is far broader than a simple guide. A misleading manifest reduces scrutiny and can cause long-running automation to be enabled without adequate risk acknowledgment.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The content mentions monitoring and automation utilities that operate on live account state, write logs, and potentially trigger notifications, which is far broader than a simple guide. A misleading manifest reduces scrutiny and can cause long-running automation to be enabled without adequate risk acknowledgment.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The content mentions monitoring and automation utilities that operate on live account state, write logs, and potentially trigger notifications, which is far broader than a simple guide. A misleading manifest reduces scrutiny and can cause long-running automation to be enabled without adequate risk acknowledgment.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

The manifest's install command fetches and executes a remote shell script from the internet. This is a classic supply-chain and remote-code-execution risk because trust is delegated entirely to a mutable external resource at execution time.

Content

Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.

md
version: "2.0"
description: Grove CLI guide - philosophy, commands, and quick start
homepage: https://grove.city
install: curl -fsSL https://grove.city/install-cli.sh | bash
updated: 2026-02-10
user-invocable: true
metadata:

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

Piping network-retrieved content directly into bash is dangerous command chaining because it combines download and execution with no inspection boundary. This eliminates opportunities for validation and makes compromise of the upstream source immediately exploitable.

Content

Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.

md
version: "2.0"
description: Grove CLI guide - philosophy, commands, and quick start
homepage: https://grove.city
install: curl -fsSL https://grove.city/install-cli.sh | bash
updated: 2026-02-10
user-invocable: true
metadata:

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md
**Requirements:**

- Bash or Zsh shell
- curl (for installation)
- Optional: Python/Node for agent integration

# Grove CLI — Complete Guide <!-- omit in toc -->

Hidden Instructions

High
Category
Prompt Injection
Confidence
70% confidence
Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.

md
- curl (for installation)
- Optional: Python/Node for agent integration

# Grove CLI — Complete Guide <!-- omit in toc -->

**Grove enables agents and humans to send micro-tips as quality signals for content.**

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

The installation section teaches the same unsafe download-to-shell pattern, reinforcing insecure operator behavior. In a skill meant for agents and humans, this is especially risky because agents may automate the exact chain without review.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

Installation

bash
curl -fsSL https://grove.city/install-cli.sh | bash

What gets installed:

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The guide directs storage of a wallet private key in ~/.grove/keyfile.txt without any security warning, access-control guidance, or mention of encryption. Plaintext private key storage materially increases the risk of credential theft from local compromise, backups, logs, or permissive file permissions.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
99% confidence
Finding

The quick-start section repeats the pattern of downloading and executing a remote installer in one step. Repetition in the operational path increases the likelihood that users or agents will execute unverified code without scrutiny.

Content

Scanner excerpt · SKILL.md (reported line 254)May include surrounding context.

bash
# 1. Install
curl -fsSL https://grove.city/install-cli.sh | bash

# 2. Create wallet + fund it
grove setup    # Choose option 2: Wallet + Crypto

Chaining Abuse

High
Category
Tool Misuse
Confidence
98% confidence
Finding

The agent wallet mode quick start again uses chained remote script execution, now in a context that leads directly into wallet creation and funding. That combination heightens impact because compromised installer code could immediately target credentials or funds.

Content

Scanner excerpt · SKILL.md (reported line 254)May include surrounding context.

bash
# 1. Install
curl -fsSL https://grove.city/install-cli.sh | bash

# 2. Create wallet + fund it
grove setup    # Choose option 2: Wallet + Crypto

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

This skill is described as a CLI guide/documentation aid, but the script performs real financial operations by automatically funding a Grove account. That mismatch is dangerous because users may trust or run the skill expecting passive guidance, while it can move funds from a local wallet and trigger on-chain transactions.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

The script instructs users to install the CLI via a 'curl | bash' pipeline, which executes remote code directly without prior verification. If the remote host, connection, or served script is compromised, users could execute arbitrary code on their machine, which is especially serious in a skill that also interacts with wallet material and funding flows.

Content

Scanner excerpt · scripts/auto-fund.sh (reported line 118)May include surrounding context.

sh
# Check if grove CLI is available
if ! command -v grove &> /dev/null; then
    echo -e "${RED}Error: grove CLI not found${NC}" >&2
    echo "Install with: curl -fsSL https://grove.city/install-cli.sh | bash" >&2
    exit 1
fi

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script autonomously decides when to fund based on balance thresholds and is designed for cron-driven repeated execution, which creates unattended spending behavior. In the context of a CLI guide skill, this capability is unjustified and increases the chance of unintended or excessive funding if balances are misread, outputs are spoofed, or the environment is manipulated.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/batch-tip.sh (reported line 102)May include surrounding context.

sh
# Check if grove CLI is available
if ! command -v grove &> /dev/null; then
    echo -e "${RED}Error: grove CLI not found${NC}" >&2
    echo "Install with: curl -fsSL https://grove.city/install-cli.sh | bash" >&2
    exit 1
fi

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/monitor-balance.sh (reported line 106)May include surrounding context.

sh
# Check if grove CLI is available
if ! command -v grove &> /dev/null; then
    echo -e "${RED}Error: grove CLI not found${NC}" >&2
    echo "Install with: curl -fsSL https://grove.city/install-cli.sh | bash" >&2
    exit 1
fi

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

This script performs real financial operations, including live balance checks and on-chain tipping, despite the skill being presented as a CLI guide/documentation asset. That mismatch is dangerous because users may treat it as informational helper content while it can move funds, increasing the risk of unintended transfers or social-engineered execution.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script automates batch financial transfers using grove tip with --yes, which suppresses command-level confirmation and enables repeated payments from a file. In the context of a documentation/guide skill, this capability is unjustified and increases the likelihood of accidental or bulk unauthorized value transfer if a user runs it on untrusted or mistaken input.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The file implements an active monitoring utility with logging, alerting, and a persistent loop, which materially exceeds the declared skill purpose of being a CLI guide/documentation resource. In an agent-skill context, hidden operational behavior increases attack surface and user surprise because a documentation skill is not expected to perform ongoing account-state monitoring.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

This code sends account balance data to an arbitrary user-supplied webhook, creating external data transmission that is not justified by a documentation-only skill. Even if intended for legitimate alerting, outbound egress from an unexpectedly included script can leak operational or financial information to third parties.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill advertises shell-driven installation and operational workflows but does not declare any tool scope or allowed-tools boundaries. In an agent ecosystem, missing capability constraints increases the chance an agent executes shell commands unexpectedly, especially because the document includes install, setup, funding, and tipping commands.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill is presented as documentation, yet it contains concrete executable instructions for installation, wallet creation, account funding, and sending real tips. In agent contexts, documentation-like packaging around transactional behavior can induce execution without sufficient safety gating.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest instructs users to pipe a remote script directly into bash, which executes unreviewed network content immediately with local shell privileges. If the remote server, transport, or script is compromised, this becomes a direct arbitrary code execution path.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The guide includes handling of sensitive wallet material and autonomous funding/tipping workflows, which materially expands the skill's security footprint beyond a basic CLI reference. Exposure or misuse of wallet keys and unattended funding logic can directly lead to asset loss.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
78% confidence
Finding

The workflow encourages persistent local wallet state and ongoing funded usage, which creates session persistence around sensitive financial capabilities. In agent contexts, persistent credentials and funded wallets enlarge the blast radius of later compromise or unintended invocation.

Content

Scanner excerpt · SKILL.md (reported line 256)May include surrounding context.

md
# 1. Install
curl -fsSL https://grove.city/install-cli.sh | bash

# 2. Create wallet + fund it
grove setup    # Choose option 2: Wallet + Crypto

# 3. Start tipping

Static analysis

No suspicious patterns detected.