ClawHub
Back to skill

Security audit

Liquidity Planner

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its PancakeSwap liquidity-planning purpose, but it includes unnecessary hidden telemetry and some overbroad or risky execution guidance around live DeFi links.

Review this skill before installing. Its PancakeSwap research and deep-link generation are understandable, but it sends local environment metadata to pancakeswap.ai without a clear need, can open live DeFi pages, and gives imperfect shell-safety guidance. Only use it if you are comfortable with those network disclosures, independently verify all token addresses and domains, and review every wallet approval or deposit before signing.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

other

Warning
Location
SKILL.md:68
Finding

Mandatory External Telemetry Exceeds the Skill's Functional Requirements

Content
View full analysis
/dev/null & ``` ``` ### Technical Analysis The mandatory initialization request sends the following local execution metadata to `pancakeswap.ai`: - AI agent or system identifier - Skill name and version - Execution timestamp - Operating system name - System architecture The HTTP response is written to `/dev/null`, errors are suppressed, and the request runs in the background. Consequently, the operation does not retrieve or process a token list, deep-link format, or other information required by the declared liquidity-planning workflow. It therefore cannot provide the stated initialization benefit. Market-data requests to DexScreener, DefiLlama, PancakeSwap's token list, and public blockchain RPC endpoints are relevant to pool discovery and token verification. This telemetry request is materially different: it reports execution-environment information without contributing data to the planning result. Although the transmitted fields do not include wallet private keys or API credentials, their combination permits environment fingerprinting and correlation of Skill usage. Mandatory collection exceeds the minimum network access necessary for the declared functionality. ### Attack Path 1. A user activates the liquidity-planner Skill. 2. The Skill directs the agent to execute Step 0 ...[truncated 1057 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:58
Finding

Unsafe Interpolation of User Input into Shell Variable Assignments

Content
View full analysis
`, `#`, and parentheses. As a result, the stated validation policy is insufficient to make direct interpolation into shell source safe. For example, if a malicious token-search keyword is interpolated as documented: ```text x' > /tmp/clawhub-proof # ``` the resulting shell source becomes: ```bash KEYWORD='x' > /tmp/clawhub-proof #' ``` The shell interprets the redirection rather than treating the entire value as token-search data. This example can create or truncate a file writable by the agent. More damaging targets could be selected wherever the executing account has write permission. Quoting `"$KEYWORD"` in the later `curl` command does not mitigate this issue bec ...[truncated 1672 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (19)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest description includes generic activation phrases like "provide liquidity" and "farm pancakeswap," plus a broad natural-language condition about depositing tokens into liquidity pools. Because this is a markdown/manifest-scoped trigger description, these phrases are not narrowly constrained and may overlap with ordinary DeFi discussion or requests intended for other platforms.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 7)May include surrounding context.

md
description: Plan liquidity provision on PancakeSwap. Use when user says "add liquidity on pancakeswap", "provide liquidity", "LP on pancakeswap", "farm pancakeswap", or describes wanting to deposit tokens into liquidity pools without writing code.
homepage: https://github.com/pancakeswap/pancakeswap-ai
allowed-tools: Read, Write, Edit, Glob, Grep, Bash(curl:*), Bash(jq:*), Bash(cast:*), Bash(xdg-open:*), Bash(open:*), WebFetch, WebSearch, Task(subagent_type:Explore), AskUserQuestion
model: sonnet
license: MIT
metadata:
  author: pancakeswap

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The initialization step sends agent name, timestamp, OS, and architecture to pancakeswap.ai before any LP planning occurs. This is unnecessary for the core task and creates undisclosed metadata exfiltration, which is especially risky in agent environments where platform and system characteristics should not be shared without need and consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill describes a network initialization call that transmits system metadata without any user-facing disclosure or consent step. Hidden or poorly disclosed outbound metadata transfer is dangerous because it can leak environment details and undermine trust, even if the payload seems minor.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.

md
[[ "$TOKEN" =~ ^0x[0-9a-fA-F]{40}$ ]] || { echo "Invalid token address"; exit 1; }

# name() selector = 0x06fdde03
curl -sf -X POST "$RPC" \
  -H "Content-Type: application/json" \
  -d "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"eth_call\",\"params\":[{\"to\":\"$TOKEN\",\"data\":\"0x06fdde03\"},\"latest\"]}" \
  | jq -r '.result'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

To find all PancakeSwap pools containing a specific token:

bash
curl -s "https://api.dexscreener.com/latest/dex/tokens/{tokenAddress}" | \
  jq '.pairs[] | select(.dexId == "pancakeswap")'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 217)May include surrounding context.

To find all PancakeSwap pools containing a specific token:

bash
curl -s "https://api.dexscreener.com/latest/dex/tokens/{tokenAddress}" | \
  jq '.pairs[] | select(.dexId == "pancakeswap")'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 246)May include surrounding context.

To find all PancakeSwap pools containing a specific token:

bash
curl -s "https://api.dexscreener.com/latest/dex/tokens/{tokenAddress}" | \
  jq '.pairs[] | select(.dexId == "pancakeswap")'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/data-providers.md (reported line 36)May include surrounding context.

To find all PancakeSwap pools containing a specific token:

bash
curl -s "https://api.dexscreener.com/latest/dex/tokens/{tokenAddress}" | \
  jq '.pairs[] | select(.dexId == "pancakeswap")'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/data-providers.md (reported line 43)May include surrounding context.

To find all PancakeSwap pools containing a specific token:

bash
curl -s "https://api.dexscreener.com/latest/dex/tokens/{tokenAddress}" | \
  jq '.pairs[] | select(.dexId == "pancakeswap")'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/data-providers.md (reported line 52)May include surrounding context.

To find all PancakeSwap pools containing a specific token:

bash
curl -s "https://api.dexscreener.com/latest/dex/tokens/{tokenAddress}" | \
  jq '.pairs[] | select(.dexId == "pancakeswap")'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/data-providers.md (reported line 59)May include surrounding context.

To find all PancakeSwap pools containing a specific token:

bash
curl -s "https://api.dexscreener.com/latest/dex/tokens/{tokenAddress}" | \
  jq '.pairs[] | select(.dexId == "pancakeswap")'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/data-providers.md (reported line 68)May include surrounding context.

To find all PancakeSwap pools containing a specific token:

bash
curl -s "https://api.dexscreener.com/latest/dex/tokens/{tokenAddress}" | \
  jq '.pairs[] | select(.dexId == "pancakeswap")'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/data-providers.md (reported line 75)May include surrounding context.

To find all PancakeSwap pools containing a specific token:

bash
curl -s "https://api.dexscreener.com/latest/dex/tokens/{tokenAddress}" | \
  jq '.pairs[] | select(.dexId == "pancakeswap")'

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/data-providers.md (reported line 233)May include surrounding context.

To find all PancakeSwap pools containing a specific token:

bash
curl -s "https://api.dexscreener.com/latest/dex/tokens/{tokenAddress}" | \
  jq '.pairs[] | select(.dexId == "pancakeswap")'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file provides ready-to-use PancakeSwap deep links that streamline a path into wallet-connected DeFi actions, but it does not warn users that opening such links can lead to transactions affecting real assets. In this skill context, deep links materially increase actionability, so lack of safety messaging raises the chance of unintended or insufficiently reviewed fund movements.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This section gives prescriptive liquidity strategy guidance, including aggressive and balanced range recommendations, without clearly warning users about material financial risks such as impermanent loss, range exhaustion, volatility, and the need for active monitoring. In a skill designed to help users add liquidity on PancakeSwap, omission of risk warnings can mislead users into taking actions that may directly cause loss of funds.

Content

No source excerpt is available for this finding.

Unbounded Output

Medium
Category
Output Handling
Confidence
80% confidence
Finding

Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.

Content

Scanner excerpt · references/position-types.md (reported line 409)May include surrounding context.

md
| Parameter | Purpose | Example |
|-----------|---------|---|
| `inputCurrency` | Pre-fill amount input | `&inputCurrency=0.5` |
| `outputCurrency` | Pre-fill output amount | `&outputCurrency=1000` |
| `pMin` | Slippage tolerance | `&pMin=0.95` |
| `pMax` | Price impact cap | `&pMax=1.05` |

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill says it only plans liquidity provision, but then instructs the agent to launch the generated PancakeSwap URL in a browser. That crosses from passive planning into active navigation toward a live transaction flow, which can increase the chance of users being funneled into signing unintended or insufficiently reviewed transactions.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.