Security audit

Crypto Genie

Security checks for vulnerabilities and agentic risk

Overview

Crypto Genie is a purpose-aligned crypto address checker, but its main check path, storage behavior, credentials guidance, and background worker are materially broader than some of its security claims disclose.

Install only after reviewing the privacy and operational tradeoffs: checking an uncached address can contact Etherscan with your API key, the tool keeps local wallet-analysis history, and cron/systemd sync should be bounded and protected with locks. Treat results as heuristic risk signals, not proof that an address is safe or unsafe, and avoid storing real API keys in shell history, crontab lines, or broadly readable files.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (8)

T09 · Insecure Skill Coding Practices

Error

Location: sync_worker.py:29
Finding: Etherscan API Key Exposed in Request URLs and Worker Output
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Error

Location: sync_worker.py:283
Finding: Scheduled Batch Worker Can Accumulate Indefinitely
Content: View full analysis
= max_jobs: print(f"\n✅ Completed {jobs_processed} jobs. Stopping.") break await asyncio.sleep(delay) ``` The recommended scheduled command is: ```bash */10 * * * * cd /path/to/crypto-genie && source venv/bin/activate && ETHERSCAN_API_KEY="your_key" python3 sync_worker.py --max-jobs 30 --delay 2.0 >> logs/sync.log 2>&1 ``` The systemd documentation additionally recommends: ```ini [Service] Type=simple User=ubuntu WorkingDirectory=/home/ubuntu/.openclaw/workspace/skills/crypto-genie ExecStart=/home/ubuntu/.openclaw/workspace/skills/crypto-genie/venv/bin/python3 sync_worker.py Environment="ETHERSCAN_API_KEY=your_key" Restart=always ``` ### Technical Analysis The `--max-jobs` option only causes termination after the specified number of successful jobs. If the queue is empty, has fewer jobs than the limit, or jobs repeatedly fail, the worker remains in its infinite loop. When invoked by cron every ten minutes, each previous idle worker can remain alive while another instance starts. There is no process lock, idle timeout, queue-empty exit behavior, or concurrency control preventing multiple workers from running simultaneously. The persistence mechanism ...[truncated 1095 chars]
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: crypto_check_db.py:215
Finding: Attacker-Controlled Blockchain Messages Are Returned to the Agent Without Isolation
Content: View full analysis
Optional[str]: try: if not hex_data or hex_data == '0x': return None hex_clean = hex_data[2:] if hex_data.startswith('0x') else hex_data data_bytes = bytes.fromhex(hex_clean) message = data_bytes.decode('utf-8', errors='ignore') message = ''.join( char for char in message if char.isprintable() or char in '\n\r\t' ) return message.strip() if message.strip() else None except Exception: return None ``` ```python decoded_message = self.decode_hex_message(input_data) if decoded_message: is_suspicious, reason = self.analyze_transaction_message(decoded_message) if is_suspicious: tx_data = { 'tx_hash': tx.get('hash'), 'address': address, 'block_number': int(tx.get('blockNumber', 0)), 'timestamp': int(tx.get('timeStamp', 0)), 'from_address': tx.get('from'), 'to_address': tx.get('to'), 'value': tx.get('value'), 'input_data': input_data[:1000], 'decoded_message': decoded_message[:1000], 'is_suspicious': True, 'suspicion_reason': reason } ``` ```python result['suspicious_transactions'].append({ 'tx_hash': tx['tx_hash'], 'reason': tx['suspicion_reason'], 'message_preview': tx['decoded_message'][:100] if tx['decoded_message'] else None }) ``` ```python if tx['message_preview']: lines.append(f" Message: \"{tx['message_preview']}...\"") ``` ### Technical Analysis Ethereum transaction input is controlled by transaction senders. The worke ...[truncated 1454 chars]
Remediation: View remediation

other

Warning

Location: crypto_check_db.py:127
Finding: Primary Check Command Performs Undisclosed Real-Time Network Synchronization
Content: View full analysis
Dict: scanner = blockchain_info['scanner'] chain_name = blockchain_info['name'] api_key = get_api_key() if not api_key: return { 'error': True, 'message': 'API key not configured. Please run: ./setup.sh' } print( f"⏳ Address not in database. " f"Fetching from {blockchain_info['explorer']}..." ) try: if scanner == 'etherscan': syncer = EtherscanSyncer(api_key, db) success = await syncer.sync_address(address) ``` ```python address_data = db.get_address(address) if not address_data: if scanner not in ['etherscan', 'solana']: return { 'address': address, 'blockchain': chain_name, 'scanner': scanner, 'error': True, 'message': ( f"{chain_name} support coming soon! " "Currently only Ethereum and Solana are supported." ) } print(f"🔍 Detected: {chain_name}") sync_result = await sync_address_realtime( address, db, blockchain_info ) ``` The authoritative Skill text states: ```text No external API calls during checks! ``` and: ```text All checks query local SQLite database. ``` ### Technical Analysis The declared command is `python3 crypto_check_db.py`. For every valid Ethereum address absent from the local database, that command immediately invokes `EtherscanSyncer`, which sends four requests to Etherscan. This behavior contradicts the Skill's repeated claims that checks are database-only and do not make external API calls. Wallet addresses are public block ...[truncated 918 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: README.md:251
Finding: Documentation Encourages Persistent Plaintext API-Key Storage
Content: View full analysis
> logs/sync.log 2>&1 ``` ```bash echo 'export ETHERSCAN_API_KEY="your_key"' >> ~/.bashrc source ~/.bashrc ``` ```ini [Service] Type=simple User=ubuntu WorkingDirectory=/home/ubuntu/.openclaw/workspace/skills/crypto-genie ExecStart=/home/ubuntu/.openclaw/workspace/skills/crypto-genie/venv/bin/python3 sync_worker.py Environment="ETHERSCAN_API_KEY=your_key" Restart=always ``` ### Technical Analysis The project includes encrypted local key storage, but its unattended-execution documentation bypasses that mechanism and embeds the key directly in crontab entries, shell startup files, and systemd unit files. These files are persistent, commonly included in backups and support bundles, and visible to administrators or software with access to the user's configuration. A key exported through `.bashrc` also becomes available to every descendant process of an interactive shell. ### Attack Path 1. A user follows the documented setup instructions. 2. The user inserts a real API key into `.bashrc`, crontab, or a systemd unit. 3. The secret remains on disk in plaintext across sessions. 4. A local process, administrator, backup operator, support bundle, or compromised account reads the configuration. 5. The recovered key is reused against Etherscan or correlated with the user's query activity. ### Impact Assessment The exposure is limited to the Etherscan credential and related API quota; it does not directly expose wallet private keys. The systemd example may place the key in a root-controlled configuration file, while `.bashrc` and user crontab expose ...[truncated 43 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: database.py:15
Finding: Wallet Query History Is Stored with Insufficient Filesystem Protection
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: install.sh:11
Finding: Installer Silently Executes Dependency Artifacts Without Hash Verification
Content: View full analysis
&1 exec 4>&2 exec 1>/dev/null 2>&1 ``` ```bash # Create virtual environment if it doesn't exist if [ ! -d "$SKILL_DIR/venv" ]; then python3 -m venv "$SKILL_DIR/venv" fi # Activate and install dependencies source "$SKILL_DIR/venv/bin/activate" pip install --upgrade pip pip install -r "$SKILL_DIR/requirements.txt" # Make scripts executable chmod +x "$SKILL_DIR/crypto_check.py" 2>/dev/null || true chmod +x "$SKILL_DIR/setup.sh" 2>/dev/null || true ``` ```text fastapi==0.109.0 uvicorn[standard]==0.27.0 pydantic==2.5.3 httpx==0.26.0 python-dateutil==2.8.2 cryptography==42.0.5 ``` ### Technical Analysis The installer retrieves and executes third-party package installation artifacts from the configured Python package index. Most top-level versions are pinned, but no artifact hashes are supplied, and transitive dependency versions are not locked. The installer also upgrades pip, introducing another mutable network-sourced component. All pip output is redirected to `/dev/null`, hiding the selected package source, resolved artifacts, warnings, and integrity-related diagnostics. No reviewed dependency name is demonstrably malicious. The vulnerability is the unsafe installation process and reduced ability to detect a compromised or substituted artifact. ### Attack Path 1. A user runs `bash install.sh`. 2. Pip connects to its configured package index or mirror. 3. A compromised index, malicious mirror, altered DNS/proxy configuration, or replaced artifact supplies unexpected package content. 4. Pip executes package build or installation code with the user's privileges. 5. Relevant source and warning output is discarded by the installer. 6. The installed package can access files, environment variab ...[truncated 391 chars]
Remediation: View remediation

other

Warning

Location: sync_worker.py:210
Finding: Risk Scoring Reports Unverified Contracts Without Performing Verification
Content: View full analysis
= 80, 'is_contract': is_contract, 'is_verified': False, 'balance_wei': balance_wei, 'balance_eth': balance_eth, 'transaction_count': tx_count, 'first_seen_block': int(tx_list[0]['blockNumber']) if tx_list else None, 'last_seen_block': int(tx_list[-1]['blockNumber']) if tx_list else None, 'synced': True, 'metadata': { 'suspicious_tx_count': len(suspicious_transactions), 'last_sync': datetime.utcnow().isoformat() } } ``` Low-risk output includes: ```python result['recommendations'] = [ '✅ No major red flags detected', 'ℹ️ Proceed with normal caution', '🔍 Always verify the recipient address', '📊 Monitor transaction after sending' ] ``` ### Technical Analysis The worker never queries whether contract source code is verified. Instead, it assigns `is_verified = False` to every detected contract and adds 30 risk points on that basis. This produces a false contract-verification finding. The inverse problem also exists: a low risk score produces reassuring output even though only the latest subset of transaction data is inspected and detection rel ...[truncated 998 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (62)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The README and manifest messaging claim 'No external API calls during checks,' but the same document later states that unknown addresses trigger real-time Etherscan lookups and local storage. This is a security-relevant documentation integrity issue because users may expose queried wallet addresses and rely on inaccurate privacy assumptions when using the skill.
Content: No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · README.md (reported line 85)May include surrounding context.
890abcdef12345678

With JSON output

python3 crypto_check_db.py 0x1234... --json

Convenience script (syncs in background if needed)

./check_address.sh 0x1234...

text
### 4. Optional: Background Sync Worker For bulk processing or scheduled syncs: ```bash # Run continuously (processes queue) python3 sync_worker.py # Process N addresses then stop python3 sync_worker.py --max-jobs 20 # Add to crontab for periodic syncing # Every 10 minutes, process 30 addresses */10 * * * * cd /path/to/crypto-genie && source venv/bin/activate && python3 sync_worker.py --max-jobs 30

📖 Documentation

Document Description
SKILL.md Complete usage guide with examples and commands
DATABASE_ARCHITECTURE.md Technical deep dive into database schema and architecture
SECURITY.md Security best practices and encryption details
CHANGELOG.md Version history and m

Document	Description
SKILL.md	Complete usage guide with examples and commands
DATABASE_ARCHITECTURE.md	Technical deep dive into database schema and architecture
SECURITY.md	Security best practices and encryption details
CHANGELOG.md	Version history and m

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SECURITY.md (reported line 78)May include surrounding context.

Use .gitignore: Exclude sensitive files
text
.env *.key secrets/

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SECURITY.md (reported line 85)May include surrounding context.

Use .gitignore: Exclude sensitive files
text
.env *.key secrets/

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The overall presentation can cause users to believe they are interacting with a fully local, comprehensive security assistant, while the documented model is closer to a queued ETL workflow with heuristic reporting and external data dependence. In a security skill, this kind of trust inflation is particularly risky because a false sense of safety can directly lead to financial loss.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The overall presentation can cause users to believe they are interacting with a fully local, comprehensive security assistant, while the documented model is closer to a queued ETL workflow with heuristic reporting and external data dependence. In a security skill, this kind of trust inflation is particularly risky because a false sense of safety can directly lead to financial loss.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The overall presentation can cause users to believe they are interacting with a fully local, comprehensive security assistant, while the documented model is closer to a queued ETL workflow with heuristic reporting and external data dependence. In a security skill, this kind of trust inflation is particularly risky because a false sense of safety can directly lead to financial loss.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The overall presentation can cause users to believe they are interacting with a fully local, comprehensive security assistant, while the documented model is closer to a queued ETL workflow with heuristic reporting and external data dependence. In a security skill, this kind of trust inflation is particularly risky because a false sense of safety can directly lead to financial loss.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The overall presentation can cause users to believe they are interacting with a fully local, comprehensive security assistant, while the documented model is closer to a queued ETL workflow with heuristic reporting and external data dependence. In a security skill, this kind of trust inflation is particularly risky because a false sense of safety can directly lead to financial loss.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The overall presentation can cause users to believe they are interacting with a fully local, comprehensive security assistant, while the documented model is closer to a queued ETL workflow with heuristic reporting and external data dependence. In a security skill, this kind of trust inflation is particularly risky because a false sense of safety can directly lead to financial loss.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The overall presentation can cause users to believe they are interacting with a fully local, comprehensive security assistant, while the documented model is closer to a queued ETL workflow with heuristic reporting and external data dependence. In a security skill, this kind of trust inflation is particularly risky because a false sense of safety can directly lead to financial loss.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The overall presentation can cause users to believe they are interacting with a fully local, comprehensive security assistant, while the documented model is closer to a queued ETL workflow with heuristic reporting and external data dependence. In a security skill, this kind of trust inflation is particularly risky because a false sense of safety can directly lead to financial loss.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The overall presentation can cause users to believe they are interacting with a fully local, comprehensive security assistant, while the documented model is closer to a queued ETL workflow with heuristic reporting and external data dependence. In a security skill, this kind of trust inflation is particularly risky because a false sense of safety can directly lead to financial loss.
Content: No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.
bash
# Check address (instant, database-only) python3 crypto_check_db.py 0x1234567890abcdef1234567890abcdef12345678

4. Run Background Sync Worker

Manual mode:

bash
python3 sync_worker.py # Runs continuously, processes queue

Batch mode:

bash
python3 sync_worker.py --max-jobs 20 # Process 20 addresses then exit

Cron schedule (recommended):

bash
# Add to crontab */10 * * * * cd ~/.openclaw/workspace/skills/crypto-genie && source venv/bin/activate && ETHERSCAN_API_KEY="key" python3 sync_worker.py --max-jobs 30

💡 How It Works

Architecture Flow

text
User checks address ↓ ┌──────────────────┐ │ crypto_check_db │ ← Queries local database ONLY └────────┬─────────┘ (No external API calls) │ ↓ ┌──────────────────────┐ │ Local SQLite DB │ │ ~/.config/crypto-

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script's check path conditionally performs a live synchronization via Etherscan when an address is missing from the local database, directly contradicting the stated 'No external API calls during checks!' and 'database-first' design. This hidden network behavior expands the trust boundary, can leak user-queried addresses to a third party, and makes a supposedly offline/safe verification flow depend on external data and availability.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The module docstring describes the tool as a database-only checker, yet the implementation performs live scanner synchronization for unknown addresses. In a security tool handling potentially sensitive wallet investigations, this mismatch can mislead users into exposing addresses, timing, and investigative intent to third parties.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill metadata and behavior claim checks are database-only with no external API calls, but a cache miss causes the code to fetch data from an external blockchain scanner using an API key. This creates undisclosed network exfiltration of the user-supplied address and defeats the privacy and trust assumptions a caller would reasonably rely on.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: fastapi==0.109.0 — 1 advisory(ies): CVE-2024-24762 (FastAPI is a web framework for building APIs with Python 3.8+ based on standard )

High

Category: Supply Chain
Confidence: 93% confidence
Finding: Pinning FastAPI to 0.109.0 retains a version with a known security advisory (CVE-2024-24762). In an API-serving skill, framework vulnerabilities can expose request handling, documentation endpoints, or application behavior to denial of service or other compromise depending on how the framework feature is used.
Content: No source excerpt is available for this finding.

Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'

High

Category: Supply Chain
Confidence: 70% confidence
Finding: Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: cryptography==42.0.5 — 11 advisory(ies): GHSA-537c-gmf6-5ccf (Vulnerable OpenSSL included in cryptography wheels); CVE-2024-12797 (Vulnerable OpenSSL included in cryptography wheels); GHSA-h4gh-qq45-vh27 (pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels) +8 more

High

Category: Supply Chain
Confidence: 97% confidence
Finding: Pinning cryptography==42.0.5 may pull wheels bundled with vulnerable OpenSSL components, as reflected by multiple advisories. Since this skill advertises secure key storage, weaknesses in the crypto stack are especially concerning because they can undermine confidentiality, integrity, or trust in cryptographic operations.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The code makes multiple outbound requests to Etherscan even though the skill metadata claims 'No external API calls during checks.' In a security-focused skill, that mismatch is dangerous because users or operators may rely on the manifest for privacy and trust decisions, while address data and operational behavior are actually sent to a third party.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest describes the skill as making no external API calls during checks, suggesting a fully local safety assistant. This document states the design includes a background sync worker that fetches data from Etherscan, meaning the skill's actual architecture depends on external API access to perform its analysis pipeline.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill fetches transaction data from Etherscan, decodes input payloads, and stores decoded messages locally, but the documentation does not prominently warn users that potentially sensitive on-chain message content will be retained on disk. This creates a privacy and data-handling risk because users may assume the tool performs ephemeral checks only, while it actually persists analyzed content in a local database.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The deployment examples place the Etherscan API key directly in shell commands, crontab entries, and systemd environment lines without warning about secret exposure. This can leak credentials through shell history, process listings, configuration files, or world-readable service metadata, enabling unauthorized API use or key abuse.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · DATABASE_ARCHITECTURE.md (reported line 248)May include surrounding context.
Enable:

bash
sudo systemctl enable crypto-sync-worker sudo systemctl start crypto-sync-worker

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T06 · System Persistence

T01 · Skill Instruction Hijacking

other

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

other

SkillSpector

Description-Behavior Mismatch

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

With JSON output

Convenience script (syncs in background if needed)

📖 Documentation

Credential Access

Credential Access

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

4. Run Background Sync Worker

💡 How It Works

Architecture Flow

Description-Behavior Mismatch

Intent-Code Divergence

Description-Behavior Mismatch

Known Vulnerable Dependency: fastapi==0.109.0 — 1 advisory(ies): CVE-2024-24762 (FastAPI is a web framework for building APIs with Python 3.8+ based on standard )

Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'

Description-Behavior Mismatch

Description-Behavior Mismatch

Missing User Warnings

Missing User Warnings

Sudo/Root Execution

Static analysis