Security audit

Crypto Address Checker

Security checks for vulnerabilities and agentic risk

Overview

The skill performs a plausible crypto-scam check, but it misstates when wallet addresses and API-key-backed requests are sent to Etherscan and includes unsafe credential and persistence guidance.

Review carefully before installing. Do not rely on the no-external-call guarantee, use your own rotated API key through a protected secret mechanism, avoid the provided cron/systemd examples unless you harden and can remove them, and treat results as heuristic rather than authoritative financial safety advice.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: SUBMISSION.md:197
Finding: Hard-Coded Etherscan API Credential in Published Documentation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: sync_worker.py:27
Finding: API Credential Disclosure Through Request URLs and Standard Output
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Warning

Location: DATABASE_ARCHITECTURE.md:220
Finding: Persistent Background Services Store API Credentials in Plaintext Configuration
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: install.sh:12
Finding: Dependency Installation Uses Unverified Artifacts While Suppressing Diagnostics
Content: View full analysis
&1 exec 4>&2 exec 1>/dev/null 2>&1 ``` ```bash # Activate and install dependencies source "$SKILL_DIR/venv/bin/activate" pip install --upgrade pip pip install -r "$SKILL_DIR/requirements.txt" ``` The installed dependency file contains version constraints but no integrity hashes: ```text # Core Dependencies (lightweight) fastapi==0.109.0 uvicorn[standard]==0.27.0 pydantic==2.5.3 # HTTP Client (for future API calls) httpx==0.26.0 # Utilities python-dateutil==2.8.2 # Secure key storage cryptography==42.0.5 ``` ### Technical Analysis The installer downloads and installs executable Python packages from the user's configured package index without verifying cryptographic artifact hashes. It also upgrades `pip` dynamically and suppresses standard output and standard error for the installation process. Most application dependencies are version-pinned, which reduces uncontrolled upgrades, but a version pin does not establish artifact integrity. A compromised package index, configured mirror, DNS/TLS trust environment, or upstream release artifact could result in different code being installed under the expected version. Suppressed diagnostics make certificate, index-selection, dependency-resolution, and installation warnings difficult for the user to inspect. ### Attack Path 1. A user executes `install.sh`. 2. The script upgrades `pip` and resolves dependencies through the configured Python package source. 3. An attacker compromises that source, an upstream artifact, or the user's package-index configuration. 4. The installer downloads the attacker's artifact because no expected hash is enforced. 5. Package installation code executes with the privileges of the user running the installer ...[truncated 405 chars]
Remediation: View remediation

other

Warning

Location: crypto_check_db.py:31
Finding: Address Checks Perform Undisclosed Real-Time Network Transmission
Content: View full analysis
Dict: """ Sync address from appropriate blockchain scanner in real-time Returns the analysis result """ scanner = blockchain_info['scanner'] chain_name = blockchain_info['name'] # Get API key api_key = get_api_key() if not api_key: return { 'error': True, 'message': 'API key not configured. Please run: ./setup.sh' } # Show progress message print(f"⏳ Address not in database. Fetching from {blockchain_info['explorer']}...") print(f" This may take 5-10 seconds...") print() start_time = time.time() try: if scanner == 'etherscan': # Use existing Etherscan syncer syncer = EtherscanSyncer(api_key, db) # Show progress print("🔄 Step 1/4: Fetching transaction count...") await asyncio.sleep(0.1) print("🔄 Step 2/4: Fetching balance...") await asyncio.sleep(0.1) print("🔄 Step 3/4: Analyzing transactions (up to 100)...") # Actu ...[truncated 2415 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (66)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation explicitly states that address checks route to external scanners such as Etherscan and Solscan, which directly contradicts the skill metadata claim of 'No external API calls during checks!'. In a security-sensitive scam-detection skill, this discrepancy is dangerous because users or integrators may rely on the no-network guarantee for privacy, isolation, or policy compliance, while the implementation or intended design appears to perform live third-party lookups.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · MULTICHAIN_SUPPORT.md (reported line 87)May include surrounding context.
md
Each blockchain scanner requires its own API key: | Blockchain | API Key | Get Key From | |------------|---------|--------------| | Ethereum | `ETHERSCAN_API_KEY` | https://etherscan.io/apis | | Solana | `SOLANA_API_KEY` | https://pro.solscan.io/ (coming soon) |

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The examples and architecture depict live fetches from etherscan.io and solscan.io during user-initiated checks, again contradicting the stated database-first/no-external-calls behavior. This can cause privacy leakage of queried wallet addresses, break air-gapped or restricted deployments, and undermine trust in the skill's security model because operators may unknowingly permit external data exfiltration during analysis.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The document explicitly states that unknown-address checks will fetch data from Etherscan in real time, which directly contradicts the skill metadata claim that checks make no external API calls. This kind of mismatch is dangerous because operators and users may rely on the advertised offline/local-only behavior when handling sensitive addresses, while the skill actually transmits queried addresses to a third party during normal use.
Content: No source excerpt is available for this finding.

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · REALTIME_SYNC_UPDATE.md (reported line 213)May include surrounding context.
From v2.0.0 to v2.1.0:

bash
# Update skill clawhub update crypto-scam-detector # Or download new version

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SECURITY.md (reported line 78)May include surrounding context.

Use .gitignore: Exclude sensitive files
text
.env *.key secrets/

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SECURITY.md (reported line 85)May include surrounding context.

Use .gitignore: Exclude sensitive files
text
.env *.key secrets/

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The description claims broad scam protection, but the findings indicate the practical logic is limited to heuristic scoring and keyword scans while also making Etherscan calls. For a financial-security tool, shallow heuristics marketed as comprehensive protection can directly contribute to unsafe decisions and missed scams.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The description claims broad scam protection, but the findings indicate the practical logic is limited to heuristic scoring and keyword scans while also making Etherscan calls. For a financial-security tool, shallow heuristics marketed as comprehensive protection can directly contribute to unsafe decisions and missed scams.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The description claims broad scam protection, but the findings indicate the practical logic is limited to heuristic scoring and keyword scans while also making Etherscan calls. For a financial-security tool, shallow heuristics marketed as comprehensive protection can directly contribute to unsafe decisions and missed scams.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The description claims broad scam protection, but the findings indicate the practical logic is limited to heuristic scoring and keyword scans while also making Etherscan calls. For a financial-security tool, shallow heuristics marketed as comprehensive protection can directly contribute to unsafe decisions and missed scams.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The description claims broad scam protection, but the findings indicate the practical logic is limited to heuristic scoring and keyword scans while also making Etherscan calls. For a financial-security tool, shallow heuristics marketed as comprehensive protection can directly contribute to unsafe decisions and missed scams.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The description claims broad scam protection, but the findings indicate the practical logic is limited to heuristic scoring and keyword scans while also making Etherscan calls. For a financial-security tool, shallow heuristics marketed as comprehensive protection can directly contribute to unsafe decisions and missed scams.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The description claims broad scam protection, but the findings indicate the practical logic is limited to heuristic scoring and keyword scans while also making Etherscan calls. For a financial-security tool, shallow heuristics marketed as comprehensive protection can directly contribute to unsafe decisions and missed scams.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The description claims broad scam protection, but the findings indicate the practical logic is limited to heuristic scoring and keyword scans while also making Etherscan calls. For a financial-security tool, shallow heuristics marketed as comprehensive protection can directly contribute to unsafe decisions and missed scams.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The description claims broad scam protection, but the findings indicate the practical logic is limited to heuristic scoring and keyword scans while also making Etherscan calls. For a financial-security tool, shallow heuristics marketed as comprehensive protection can directly contribute to unsafe decisions and missed scams.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The description claims broad scam protection, but the findings indicate the practical logic is limited to heuristic scoring and keyword scans while also making Etherscan calls. For a financial-security tool, shallow heuristics marketed as comprehensive protection can directly contribute to unsafe decisions and missed scams.
Content: No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.
bash
# Check address (instant, database-only) python3 crypto_check_db.py 0x1234567890abcdef1234567890abcdef12345678

4. Run Background Sync Worker

Manual mode:

bash
python3 sync_worker.py # Runs continuously, processes queue

Batch mode:

bash
python3 sync_worker.py --max-jobs 20 # Process 20 addresses then exit

Cron schedule (recommended):

bash
# Add to crontab */10 * * * * cd ~/.openclaw/workspace/skills/crypto-scam-detector && source venv/bin/activate && ETHERSCAN_API_KEY="key" python3 sync_worker.py --max-jobs 30

💡 How It Works

Architecture Flow

text
User checks address ↓ ┌──────────────────┐ │ crypto_check_db │ ← Queries local database ONLY └────────┬─────────┘ (No external API calls) │ ↓ ┌──────────────────────┐ │ Local SQLite DB │ │ ~/.config/cr

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 100% confidence
Finding: The submission embeds what appears to be a live Etherscan API key directly in recommended configuration. Publishing credentials in documentation enables unauthorized third-party use, quota exhaustion, attribution abuse, and potential billing or account consequences, and it normalizes unsafe secret-handling practices for operators.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The release notes explicitly state the system will 'route to appropriate scanner API' and later mention specific third-party APIs, which directly conflicts with the skill metadata promise of 'No external API calls during checks!'. In a security-sensitive skill, this kind of documentation mismatch is dangerous because operators may deploy it under false assumptions about privacy, network isolation, data exfiltration risk, and trust boundaries.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The security section claims controls such as separate API keys and rate limiting per scanner, while the skill description simultaneously asserts there are no external API calls during checks. This inconsistency strongly suggests undisclosed outbound connectivity or misleading security claims, which can cause users to expose wallet addresses and related metadata to third parties without informed consent.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The module is marketed as a real-time cryptocurrency scam detector, but the code only classifies blockchain addresses by regex format and performs no phishing, honeypot, rug-pull, or ponzi detection. In a security skill, this functionality gap is dangerous because downstream components or users may rely on a "safe"-sounding detector that provides no actual scam analysis, creating a false sense of protection and likely missed malicious activity.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script contradicts the stated 'No external API calls during checks' guarantee by automatically triggering a live sync path when an address is missing from the local database. This creates a trust-boundary violation: a seemingly local-only check can unexpectedly perform network activity, use external credentials, and send user-supplied addresses to a third party.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Labeling the tool as a 'Database-Only Checker' while implementing automatic external synchronization is a misleading security property claim. Users or downstream agents may select this skill specifically to avoid network egress, so the mismatch can cause unintended data disclosure and unsafe deployment in restricted environments.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill metadata and behavior are inconsistent: despite claiming no external API calls during checks, the code fetches data from an external blockchain scanner and requires an API key when an address is absent from the local database. In a security tool, this kind of deception matters because it can unexpectedly transmit user-supplied wallet addresses off-box, violating privacy expectations and undermining trust boundaries.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T06 · System Persistence

T08 · Insecure Dependencies

other

SkillSpector

Description-Behavior Mismatch

Credential Access

Intent-Code Divergence

Description-Behavior Mismatch

Self-Modification

Credential Access

Credential Access

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

4. Run Background Sync Worker

💡 How It Works

Architecture Flow

Missing User Warnings

Description-Behavior Mismatch

Intent-Code Divergence

Description-Behavior Mismatch

Description-Behavior Mismatch

Intent-Code Divergence

Description-Behavior Mismatch

Static analysis