ClawHub
Back to skill

Security audit

Exoskeletons

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for an onchain NFT identity tool, but its examples encourage submitting real blockchain transactions through a third-party API with an API key and unsafe shell execution.

Review before installing. Only use this skill if you are comfortable with an agent building and potentially submitting Base transactions. Prefer wallet-native signing or a structured HTTPS client over the documented shell `curl`/`execSync` examples, use a restricted Bankr key, and confirm transaction destination, chain ID, value, and calldata before broadcasting.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:650
Finding

Shell Command Injection and API Key Exposure in Transaction Submission Example

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
SKILL.md:49
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (14)

Exfiltration Commands

High
Category
Prompt Injection
Confidence
90% confidence
Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.

md
- **Visual identity** — procedural animated SVG art that encodes who you are (reputation as complexity, activity as density, capabilities as color)
- **Name & bio** — onchain identity you choose
- **Communication** — send messages to any other Exoskeleton (direct, broadcast, or channels)
- **Storage** — per-token key-value store + Net Protocol cloud storage
- **Reputation** — provable track record (age, messages, storage writes, modules, external scores from games/protocols)
- **Modules** — upgradeable capabilities via the Module Marketplace (free + premium)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md
- **The `exoskeleton.js` helper library** (included in this project)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 113)May include surrounding context.

md
- **The `exoskeleton.js` helper library** (included in this project)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

md
- **The `exoskeleton.js` helper library** (included in this project)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 328)May include surrounding context.

md
- **The `exoskeleton.js` helper library** (included in this project)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 623)May include surrounding context.

md
- **The `exoskeleton.js` helper library** (included in this project)

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The skill instructs the agent to submit transaction JSON to an external service (Bankr) and to send an API key in the request header. Even if this is framed as normal functionality, it creates a data egress path for transaction contents and secrets, and could enable unintended signing or submission through a third party.

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

Submit the transaction via Bankr:

bash
curl -s -X POST https://api.bankr.bot/agent/submit \
  -H "X-API-Key: $BANKR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"transaction": TX_JSON}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The skill instructs the agent to submit transaction JSON to an external service (Bankr) and to send an API key in the request header. Even if this is framed as normal functionality, it creates a data egress path for transaction contents and secrets, and could enable unintended signing or submission through a third party.

Content

Scanner excerpt · SKILL.md (reported line 124)May include surrounding context.

Submit the transaction via Bankr:

bash
curl -s -X POST https://api.bankr.bot/agent/submit \
  -H "X-API-Key: $BANKR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"transaction": TX_JSON}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This repeats the recommendation to use Bankr's direct API for transaction submission, again establishing an outbound network path and dependency on an external service. Because the agent may be operating with privileged transaction context, sending requests off-platform can expose sensitive metadata or trigger real financial actions.

Content

Scanner excerpt · SKILL.md (reported line 443)May include surrounding context.

Submit using Bankr's direct API (recommended):

bash
curl -s -X POST https://api.bankr.bot/agent/submit \
  -H "X-API-Key: $BANKR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"transaction": TX_JSON}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This repeats the recommendation to use Bankr's direct API for transaction submission, again establishing an outbound network path and dependency on an external service. Because the agent may be operating with privileged transaction context, sending requests off-platform can expose sensitive metadata or trigger real financial actions.

Content

Scanner excerpt · SKILL.md (reported line 443)May include surrounding context.

Submit using Bankr's direct API (recommended):

bash
curl -s -X POST https://api.bankr.bot/agent/submit \
  -H "X-API-Key: $BANKR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"transaction": TX_JSON}'

Session Persistence

Medium
Category
Rogue Agent
Confidence
55% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 537)May include surrounding context.

md
**Storage:**
- `setData(uint256 tokenId, bytes32 key, bytes value)` — Store key-value data
- `getData(uint256 tokenId, bytes32 key) → bytes` — Read stored data
- `setNetProtocolOperator(uint256 tokenId, address operator)` — Set cloud storage pointer

**Reputation:**

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

The example uses execSync to construct and execute a curl command that includes the API key and serialized transaction data inline. This is more dangerous than a static curl snippet because it encourages shell execution with secrets in command strings, increasing the risk of credential leakage, command injection bugs, process-list exposure, and accidental submission of transactions.

Content

Scanner excerpt · SKILL.md (reported line 652)May include surrounding context.

md
function submitTx(tx) {
  const result = JSON.parse(execSync(
    `curl -s -X POST https://api.bankr.bot/agent/submit ` +
    `-H "X-API-Key: ${process.env.BANKR_API_KEY}" ` +
    `-H "Content-Type: application/json" ` +
    `-d '${JSON.stringify({ transaction: tx })}'`

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

The example uses execSync to construct and execute a curl command that includes the API key and serialized transaction data inline. This is more dangerous than a static curl snippet because it encourages shell execution with secrets in command strings, increasing the risk of credential leakage, command injection bugs, process-list exposure, and accidental submission of transactions.

Content

Scanner excerpt · SKILL.md (reported line 652)May include surrounding context.

md
function submitTx(tx) {
  const result = JSON.parse(execSync(
    `curl -s -X POST https://api.bankr.bot/agent/submit ` +
    `-H "X-API-Key: ${process.env.BANKR_API_KEY}" ` +
    `-H "Content-Type: application/json" ` +
    `-d '${JSON.stringify({ transaction: tx })}'`

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · exoskeleton.js (reported line 21)May include surrounding context.

js
*   // Writing (returns transaction JSON for Bankr)
 *   const tx = exo.buildSetName(1, "Atlas");
 *   const tx = exo.buildSendMessage(1, 42, ethers.ZeroHash, 0, "hello!");
 *   // Submit `tx` via Bankr: curl -X POST https://api.bankr.bot/agent/submit ...
 *
 * CLI:
 *   node exoskeleton.js 1

Static analysis

No suspicious patterns detected.