ClawHub
Back to skill

Security audit

OP0 Altar

Security checks for vulnerabilities and agentic risk

Overview

The skill is openly for creating Solana meme coins, but it gives an agent high-impact crypto deployment authority with weak confirmation guidance and an optional unpinned MCP server install.

Install only if you are comfortable letting the agent interact with OP0's crypto deployment API. Confirm every token field, wallet address, SOL amount, and funding address before proceeding; do not share seed phrases or private keys. Prefer the documented curl flow or a pinned, reviewed MCP server version, and rotate the OP0 API key if it may have been exposed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:143
Finding

Unpinned Third-Party MCP Package Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 143-149
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Vulnerable code:

text
openclaw config set mcpServers.op0.command "npx"
openclaw config set mcpServers.op0.args '["@op0live/mcp-server"]'
openclaw config set mcpServers.op0.env.OP0_API_KEY "op0_live_YOUR_KEY"
openclaw config set mcpServers.op0.env.OP0_API_URL "https://api.op0.live/functions/v1/altar-api-public"

Technical Analysis

The optional MCP configuration directs OpenClaw to execute @op0live/mcp-server through npx without specifying an exact version or an integrity constraint. Package resolution is therefore mutable: a later registry release can differ from the version that existed when this Skill was audited.

The package implementation is not included in the audited project, which contains only SKILL.md and package.json. Consequently, its installation scripts and runtime behavior cannot be verified from this artifact. Because the process receives OP0_API_KEY, a compromised or malicious package release could read and disclose that credential. It could also perform other actions available to the local process under the invoking user's permissions.

Attack Path

  1. An attacker compromises the publisher account, package registry entry, or a future release of @op0live/mcp-server.
  2. The user follows the documented MCP configuration, which references the package without an exact version.
  3. OpenClaw invokes npx, which resolves and runs the mutable registry package.
  4. Malicious package code executes with the permissions of the OpenClaw process.
  5. The code reads the configured OP0_API_KEY from its environment.
  6. The attacker can exfiltrate the key, issue authenticated OP0 API requests, and access any additional files or resources permitted to that process.

Impact Assessment

Successful exploitation can compromise the c ...[truncated 833 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the MCP server to a reviewed exact version, for example @op0live/mcp-server@1.2.3, rather than resolving the latest release.
  2. Verify the package's publisher, source repository, release provenance, and package contents before recommending execution.
  3. Use a lockfile and registry integrity hashes where the deployment mechanism supports them.
  4. Avoid automatic installation at runtime. Prefer a separately reviewed, explicitly installed package.
  5. Disable lifecycle scripts with --ignore-scripts where compatible, while recognizing that this does not prevent malicious runtime behavior.
  6. Run the MCP server in a restricted environment with minimal filesystem access, network access limited to the required OP0 endpoint, and no unrelated credentials.
  7. Provide the API key only to the component that requires it, rotate it after suspected exposure, and apply server-side restrictions and monitoring where available.
  8. Document the trusted package version and establish a review process before upgrading it.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (11)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md
env:
        - OP0_API_KEY
      anyBins:
        - curl
        - node
---

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md
## API Configuration

- **Base URL:** `https://api.op0.live/functions/v1/altar-api-public`
- **Auth Header:** `X-API-Key: <OP0_API_KEY>`
- **Method:** All requests are `POST` with `Content-Type: application/json`
- **Auth:** All endpoints require `X-API-Key` header except `generate-key` and `payout-tokens`

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 83)May include surrounding context.

md
## API Configuration

- **Base URL:** `https://api.op0.live/functions/v1/altar-api-public`
- **Auth Header:** `X-API-Key: <OP0_API_KEY>`
- **Method:** All requests are `POST` with `Content-Type: application/json`
- **Auth:** All endpoints require `X-API-Key` header except `generate-key` and `payout-tokens`

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

md
## API Configuration

- **Base URL:** `https://api.op0.live/functions/v1/altar-api-public`
- **Auth Header:** `X-API-Key: <OP0_API_KEY>`
- **Method:** All requests are `POST` with `Content-Type: application/json`
- **Auth:** All endpoints require `X-API-Key` header except `generate-key` and `payout-tokens`

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

md
## API Configuration

- **Base URL:** `https://api.op0.live/functions/v1/altar-api-public`
- **Auth Header:** `X-API-Key: <OP0_API_KEY>`
- **Method:** All requests are `POST` with `Content-Type: application/json`
- **Auth:** All endpoints require `X-API-Key` header except `generate-key` and `payout-tokens`

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

md
## API Configuration

- **Base URL:** `https://api.op0.live/functions/v1/altar-api-public`
- **Auth Header:** `X-API-Key: <OP0_API_KEY>`
- **Method:** All requests are `POST` with `Content-Type: application/json`
- **Auth:** All endpoints require `X-API-Key` header except `generate-key` and `payout-tokens`

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

md
## API Configuration

- **Base URL:** `https://api.op0.live/functions/v1/altar-api-public`
- **Auth Header:** `X-API-Key: <OP0_API_KEY>`
- **Method:** All requests are `POST` with `Content-Type: application/json`
- **Auth:** All endpoints require `X-API-Key` header except `generate-key` and `payout-tokens`

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The skill instructs the agent to autonomously generate an API key by transmitting a user wallet address to a third-party service, potentially without a strong consent checkpoint or disclosure of retention and trust implications. Creating credentials on behalf of a user is sensitive because the returned key grants access to account-scoped operations and cannot be retrieved again, increasing the impact of mishandling.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

If OP0_API_KEY is not set, you can generate one autonomously. The user must provide their Solana wallet address.

bash
curl -s -X POST https://api.op0.live/functions/v1/altar-api-public \
  -H "Content-Type: application/json" \
  -d '{"action":"generate-key","wallet":"USER_WALLET_ADDRESS","label":"OpenClaw Agent"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

This endpoint creates a real token deployment workflow by transmitting user-supplied token metadata and wallet information to an external service that then returns a funding address and required SOL amount. In the context of a financial crypto skill, this is high risk because a mistaken or prompt-injected invocation can lead directly to irreversible on-chain actions and fund transfers.

Content

Scanner excerpt · SKILL.md (reported line 53)May include surrounding context.

Create a new self-rewarding token on Solana. Required fields: token_name, token_ticker, marketing_wallet.

bash
curl -s -X POST https://api.op0.live/functions/v1/altar-api-public \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $OP0_API_KEY" \
  -d '{

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill does not prominently warn, before creation flow initiation, that creating an altar can trigger real on-chain token deployment and require sending SOL to a generated wallet within a time window. In a crypto-deployment skill, omission of this warning is dangerous because users may interpret the action as informational or simulated, then be steered into irreversible financial behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The behavior rule uses very broad trigger phrases like "create a coin/token/altar," which can match ordinary conversational intent and cause the agent to begin a high-impact workflow. In this skill's context, the workflow can lead to generating an on-chain token deployment and instructing the user to send SOL, so ambiguous activation materially increases the chance of unintended financial actions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.