ClawHub
Back to skill

Security audit

ATP

Security checks for vulnerabilities and agentic risk

Overview

This skill is clear about its purpose, but it lets an agent use a wallet private key to make paid remote calls without built-in per-call spending controls.

Install only with a freshly generated, low-value testnet wallet and assume every agent-triggered use can contact the ATP service, send the task inputs/description, and authorize a payment. Do not reuse a wallet that holds real assets, and prefer adding your own per-call confirmation or spending cap before enabling this in routine workflows.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill invokes a local Python script, requires an environment secret, and makes paid remote requests, but does not declare corresponding permissions in a clear manifest-level way. That mismatch increases the chance a user or hosting agent grants powerful capabilities without understanding that shell execution, network access, and secret use are required, which can lead to unintended data exposure or unreviewed external calls.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
This skill requires a wallet private key and on-chain payment signing to perform a task framed as reusable task logic, which is a disproportionate secret and financial capability for the stated purpose. If the script, dependency chain, or remote payment flow is compromised or misleading, the agent could authorize unwanted transactions or expose a sensitive key path while performing what appears to be a routine helper action.

Intent-Code Divergence

Low
Confidence
75% confidence
Finding
The documentation says the private key should never leave the environment, yet instructs users to run a script that signs payment challenges for a remote service. Even if the key is not directly transmitted, this messaging can create a false sense of safety around a workflow that still uses a highly sensitive credential in a networked payment context, increasing the risk of misuse or poor operator assumptions.

Static analysis

No suspicious patterns detected.