ClawHub
Back to skill

Security audit

xpr-governance

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly aligned with XPR governance, but it can sign irreversible mainnet votes and proposal-fee transactions using private-key environment variables that are not clearly declared in its install metadata.

Review before installing. Only use this skill with an account and permission you are comfortable letting an agent use for XPR governance transactions, and prefer a narrowly scoped permission instead of a general active key. Expect votes and proposal creation to be public, irreversible on-chain actions, and expect proposal creation to spend the applicable community fee.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The skill description frames the capability as governance interaction, but the actual behavior includes signed on-chain write operations, token transfers for proposal fees, and use of private-key material from environment variables. That mismatch is dangerous because users or reviewers may assume a mostly informational skill while it can spend assets and take irreversible governance actions, increasing the risk of accidental approval or misuse.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · src/index.ts (reported line 12)May include surrounding context.

ts
/**
 * Governance Skill — XPR Network governance (gov contract)
 *
 * Read-only tools use fetch-based RPC helpers (no signing).
 * Write tools create a session from env vars for signing transactions.
 */

// ── Types ────────────────────────────────────────

interface ToolDef {
  name: string;
  description: string;
  parameters: { type: 'object'; required?: string[]; properties: Record<string, unknown> };
  handler: (params: any) => Promise<unknown>;
}

interface SkillApi {
  registerTool(tool: ToolDef): void;
  getConfig(): Record<string, unknown>;
}

// ── Constants ────────────────────────────────────

const GOV_CONTRACT = 'gov';
const GOV_API = 'https://gov.api.xprnetwork.org/api/v1/proposals';
const GOV_WEBSITE = 'https://gov.xprnetwork.org';

const MAINNET_RPC = 'https://xpr-mainnet-rpc.saltant.io';

//

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill exposes network-backed and potentially environment-backed capabilities without explicitly declaring tool scope or permissions, which weakens reviewability and least-privilege controls. In a governance skill that can influence on-chain state and may rely on secrets for signing, undeclared capabilities make it harder for operators to understand what the skill can access and increase the chance of unintended secret or network use.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
src/index.ts:101