ClawHub
Back to skill

Security audit

graph-advocate

Security checks for vulnerabilities and agentic risk

Overview

This is mostly a disclosed blockchain-data routing skill, but it includes an optional unpinned npm execution path and broad finance-query routing that users should review before installing.

Install only if you are comfortable sending blockchain questions, wallet addresses, and trading intent to graphadvocate.com and related data providers. Use the free/no-wallet mode first, require interactive approval for any x402 payments, use a low-balance wallet, protect Token API keys/JWTs, and do not run the referenced `npx subgraph-registry-mcp` command unless you pin and audit the package version.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
references/subgraph-registry.md:29
Finding

Unpinned npm Package Execution Through npx

Content
View full analysis

Vulnerability Details

File Location: references/subgraph-registry.md, lines 29-30
Vulnerability Type: Insecure third-party dependency execution
Risk Level: Medium

Complete Code Snippet:

markdown
## npm Package
`npx subgraph-registry-mcp` — MCP server with search, schema, and execute tools.

Technical Analysis

The documented npx subgraph-registry-mcp command does not specify an exact package version or integrity value. If the package is absent from the local npm cache, npx may retrieve the current release from the configured npm registry and execute it immediately.

Consequently, the code that runs can change after this Skill has been reviewed. The instruction does not require package-source verification, version pinning, integrity validation, or sandboxing. This creates a supply-chain trust boundary inconsistent with the Skill's statement that it is instruction-only and does not execute downloaded code.

This is not evidence that the current npm package is malicious. The vulnerability is the unsafe, mutable execution mechanism and the absence of controls against a compromised publisher account, malicious future release, registry compromise, dependency compromise, or registry-configuration attack.

Attack Path

  1. An attacker compromises the npm publisher, package, one of its transitive dependencies, or the registry path used by the victim.
  2. The attacker publishes or serves a malicious version of subgraph-registry-mcp.
  3. A user or Agent follows the documented command:
    sh
    npx subgraph-registry-mcp
  4. npx resolves and downloads the mutable package release without an audited version or integrity pin.
  5. npm lifecycle logic or the package executable runs with the permissions of the invoking process.
  6. Malicious code can access resources available to that process and can present manipulated MCP tools or responses.

Impact Assessment

Successful exploi ...[truncated 701 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the direct unpinned npx command from the Skill, or replace it with an exact, independently audited version:
    sh
    npx --yes subgraph-registry-mcp@<exact-version>
  2. Verify the selected release against its expected npm provenance and integrity metadata before execution.
  3. Use a lockfile and immutable dependency installation process where possible; review and pin transitive dependencies.
  4. Disable or review npm lifecycle scripts during installation when compatible with the package.
  5. Run the MCP server in a sandbox or container with minimal filesystem access, a restricted environment, controlled outbound networking, and no unrelated credentials.
  6. Add guidance consistent with the Aave and Polymarket references: audit the package, pin a known version, verify the publisher, and execute it only after explicit user approval.
  7. Periodically reassess the pinned release and update it through a controlled review process rather than automatically accepting the latest package.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill advertises routing for 'any blockchain data question' and lists many generic crypto-related trigger terms, which can cause it to activate in broad conversational contexts beyond the user's specific intent. In an agent ecosystem, this increases the chance of over-triggering external network calls, unintended data disclosure to the remote service, or accidental exposure to paid endpoints when a blockchain topic is mentioned incidentally.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

Referencing npx subgraph-registry-mcp without a pinned version causes users to execute whatever package version is current at runtime, which can change silently or be replaced by a compromised release. Because npx fetches and runs remote code, a supply-chain compromise could lead to arbitrary code execution on the user's machine or in the agent environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
80% confidence
Finding

The markdown file instructs users to authenticate with a bearer token or API key and provides a URL to obtain the key, but it does not include any warning about protecting credentials, avoiding accidental sharing, or treating the auth material as sensitive. Because this documentation affects privacy and system integrity, a brief warning is expected under the missing user warnings rule for markdown files.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/token-api.md (reported line 64)May include surrounding context.

md
## Full Specification (optional, external reference data)

The Pinax / Edge & Node team publishes a machine-readable spec for the Token
API at **https://api.pinax.network/SKILL.md** — full endpoint list,
parameters, response schemas. It's useful for tab-completion / parameter
discovery when an agent needs an endpoint not covered above.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/x402.md (reported line 4)May include surrounding context.

md
# x402 Payment Analytics Reference

Live x402 payment data on Base via The Graph subgraph.
Endpoint: `https://api.studio.thegraph.com/query/1745687/x-402-base/version/latest`
No API key needed for this endpoint.

## Entities

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description advertises extremely broad natural-language routing for "any blockchain question" and includes a long list of trigger concepts, which can cause the skill to activate in contexts the user did not explicitly intend. Over-broad invocation increases the chance of misrouting sensitive finance- or trading-related prompts to an external service, creating unnecessary data exposure and reducing user control over tool use.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
references/subgraph-registry.md:8

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:100