ClawHub
Back to skill

Security audit

Crunch Coordinate

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for CrunchDAO CLI operations, but it can directly run wallet-backed commands that move or drain funds without requiring a final safety confirmation.

Install only if you intend to let an agent help operate CrunchDAO wallets and protocol state. Before any deposit, drain, stake, withdraw, delegate, checkpoint, create, start, or end command, require the agent to show the exact command, active profile, wallet public address, network/RPC, target, token, amount, and expected effect, then get explicit confirmation. Prefer devnet and dry runs where available, and pin/verify package versions before installing.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:17
Finding

Unpinned Global Third-Party Dependency Installation

Content
View full analysis
**Note:** Requires Python `crunch-cli` package (`pip install crunch-cli`) ``` ### Technical Analysis The documented installation commands do not pin dependencies to exact, reviewed versions. Both npm and pip therefore resolve a mutable package version at installation time. The npm dependency is installed globally. npm installation can execute package lifecycle scripts with the permissions of the user running npm, while a global installation makes the resulting executable available broadly in that user's environment. An upstream package compromise, malicious future release, or registry account takeover could consequently introduce executable code after this Skill has already been reviewed. The Python package instruction creates an additional unpinned dependency path. It also conflicts with the Skill's stated policy that only `@crunchdao/crunch-cli` should be installed. The documentation does not establish that the npm and Python packages have the same maintainer, provenance, implementation, ...[truncated 1909 chars]
Remediation
View remediation
--hash=sha256: ``` 7. Continue requiring explicit user authorization before installation, and show the exact package name, version, registry, and installation scope in the confirmation prompt. 8. Do not recommend `sudo`, administrator execution, or any other privilege elevation for package installation. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:72
Finding

Financial and Destructive Commands Execute Without Mandatory Confirmation

Content
View full analysis
` | `crunch-cli crunch get ""` | | `list crunches` | `crunch-cli crunch list` | | `get/show coordinator [address]` | `crunch-cli coordinator get [address]` | | `list coordinators` | `crunch-cli coordinator list` | | `get config` | `crunch-cli coordinator get-config` | | `checkpoint for ` | `crunch-cli crunch checkpoint-get-current ""` | | `create checkpoint ` | `crunch-cli crunch checkpoint-create "" prizes.json` | | `deposit reward ` | `crunch-cli crunch deposit-reward "" ` | | `drain ` | `crunch-cli crunch drain ""` | | `create/register cruncher` | `crunch-cli cruncher create` | | `register for ` | `crunch-cli cruncher register ""` | | `claim rewards ` | `crunch-cli cruncher claim ""` | | `show staking positions` | `crunch-cli staking positions` | | `stake/deposit ` | `crunch-cli staking deposit ` | | `delegate to ` | `crunch-cli staking delegate "" ` | | `show staking rewards` | `crunch-cli staking rewards` | | `claim staking rewards` | `crunch-cli staking claim` | | `undelegate from ` | `crunch-cli staking undelegate "" ` | | `withdraw stake ` | `crunch-cli staking withdraw ` | | `init workspace ` | `crunch-cli init-workspace ""` | | `list scenarios/simulations` | `crunch-cli model list` | | `run simulation ` | `crunch-cli model run ""` | | `register coordinator ` | `crunch-cli coordinator register " ...[truncated 4727 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

crunch drain is a destructive fund-removal operation, yet the reference gives no warning that it can withdraw remaining USDC and may be irreversible once submitted on-chain. In a coordinator-management skill, this is especially dangerous because an agent may treat the command as routine cleanup and trigger unintended asset movement from a live competition.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md
- **Stored in:** User-managed file on disk; path referenced in `~/.crunch/config.json`

**Agent rules for wallets:**
- **Never create or generate wallet keypairs** unless the user explicitly asks and understands the security implications
- **Never read or display** the contents of wallet keypair files
- **Never commit wallet files** to git — always verify `.gitignore` covers them
- **Ask the user** for the wallet path — never assume or search for keypair files

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation presents a live fund-transfer command (crunch deposit-reward) as a normal workflow step without clearly warning that it moves real USDC on-chain. In an agent skill context, terse operational references can be turned into automated actions, so the absence of explicit confirmation, dry-run guidance, and asset-impact warnings increases the chance of accidental financial loss.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The staking commands include deposit, withdraw, delegate, and undelegate operations that directly affect on-chain token positions, but the reference does not warn about real asset movement, lockups, timing, or delegation consequences. Because this skill is specifically for managing coordinators and staking via CLI, the operational context makes omission of these warnings more dangerous: an agent or operator could execute financially meaningful transactions as if they were informational commands.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.