Security audit

Crypto Scam Detector

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly performs crypto address risk checks, but it under-discloses live Etherscan lookups during checks and includes risky API-key handling examples.

Review before installing. Use only with the expectation that unknown wallet addresses may be sent to Etherscan, rotate the exposed example API key if it was real, avoid putting real keys in cron or systemd command lines, and treat risk scores as advisory rather than definitive scam determinations.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (6)

T09 · Insecure Skill Coding Practices

Error

Location: SUBMISSION.md:194
Finding: Credential-Shaped Etherscan API Key Committed in Documentation
Content: View full analysis
Remediation: View remediation

other

Warning

Location: crypto_check_db.py:133
Finding: Unknown-Address Checks Undisclosedly Transmit Addresses and API Credentials
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: sync_worker.py:278
Finding: Etherscan API Key Prefix Disclosed to Worker Logs
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: DATABASE_ARCHITECTURE.md:218
Finding: Persistent Deployment Examples Store API Keys in Plaintext
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: install.sh:31
Finding: Installer Executes Dependencies Without Artifact Integrity Verification
Content: View full analysis
&1 exec 4>&2 exec 1>/dev/null 2>&1 ``` ### Technical Analysis The installer upgrades pip without a version constraint and installs Python dependencies without cryptographic hashes. Although the application dependencies in `requirements.txt` are mostly version-pinned, version pins alone do not authenticate the exact downloaded artifacts. Python package installation can execute package build and installation logic with the privileges of the user running the installer. Suppressing installation output also reduces the user's ability to notice unexpected package sources, build behavior, warnings, or dependency substitutions. No specific malicious dependency was identified in the reviewed manifest. The finding concerns insufficient supply-chain hardening. ### Attack Path 1. A user invokes `install.sh`. 2. The script contacts the configured Python package index and upgrades pip to the currently served release. 3. It downloads dependency artifacts without validating repository-reviewed hashes. 4. If the package index, account, mirror, DNS/network trust path, or artifact is compromised, a substituted package can execute installation code. 5. The malicious installation code runs with the privileges of the user who launched the installer. ### Impact Assessment Successful exploitation could execute arbitrary code under the installing user's account, read user-accessible files and environment variables, modify the Skill virtual envir ...[truncated 203 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: database.py:16
Finding: Local Wallet-Analysis Database Is Created Without Explicit Restrictive Permissions
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Rogue AgentSelf-Modification, Session Persistence
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (80)

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill metadata promises 'No external API calls during checks,' but this document states the system routes lookups to Etherscan/Solscan and fetches live scanner data. That mismatch can mislead users and integrators about network exposure, privacy boundaries, and trust assumptions, causing them to submit sensitive wallet addresses under false expectations.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The multi-chain design described here exceeds the manifest's claimed database-first, no-external-calls model by documenting scanner-based checks, data fetching, and persistence. In a security-focused scam-detection skill, this discrepancy is especially risky because users may submit sensitive financial identifiers expecting offline or local analysis, while the system may contact external services and expand the attack/privacy surface.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · MULTICHAIN_SUPPORT.md (reported line 87)May include surrounding context.
md
Each blockchain scanner requires its own API key: | Blockchain | API Key | Get Key From | |------------|---------|--------------| | Ethereum | `ETHERSCAN_API_KEY` | https://etherscan.io/apis | | Solana | `SOLANA_API_KEY` | https://pro.solscan.io/ (coming soon) |

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The usage examples explicitly show live fetches from etherscan.io and solscan.io, directly contradicting the stated no-external-calls model. This is dangerous because users may rely on the privacy/security claim when evaluating suspicious cryptocurrency addresses, while the tool may actually disclose those addresses and metadata to third parties.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation explicitly states that checks for uncached addresses now perform live Etherscan fetches, which directly contradicts the skill's stated design constraint of 'No external API calls during checks.' This is dangerous because operators and downstream agents may rely on the manifest's privacy, determinism, and offline-safety claims, while the actual behavior introduces network dependence, metadata leakage, and a larger attack surface during security-sensitive checks.
Content: No source excerpt is available for this finding.

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · REALTIME_SYNC_UPDATE.md (reported line 213)May include surrounding context.
From v2.0.0 to v2.1.0:

bash
# Update skill clawhub update crypto-scam-detector # Or download new version

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SECURITY.md (reported line 78)May include surrounding context.

Use .gitignore: Exclude sensitive files
text
.env *.key secrets/

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SECURITY.md (reported line 85)May include surrounding context.

Use .gitignore: Exclude sensitive files
text
.env *.key secrets/

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documentation presents the skill as a local real-time detector, while the underlying behavior reportedly includes external Etherscan calls, queued background ingestion, and narrower heuristic detection than advertised. In a fraud-detection context, this mismatch can cause both privacy harm and dangerous overtrust in weak signals.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documentation presents the skill as a local real-time detector, while the underlying behavior reportedly includes external Etherscan calls, queued background ingestion, and narrower heuristic detection than advertised. In a fraud-detection context, this mismatch can cause both privacy harm and dangerous overtrust in weak signals.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documentation presents the skill as a local real-time detector, while the underlying behavior reportedly includes external Etherscan calls, queued background ingestion, and narrower heuristic detection than advertised. In a fraud-detection context, this mismatch can cause both privacy harm and dangerous overtrust in weak signals.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documentation presents the skill as a local real-time detector, while the underlying behavior reportedly includes external Etherscan calls, queued background ingestion, and narrower heuristic detection than advertised. In a fraud-detection context, this mismatch can cause both privacy harm and dangerous overtrust in weak signals.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The documentation presents the skill as a local real-time detector, while the underlying behavior reportedly includes external Etherscan calls, queued background ingestion, and narrower heuristic detection than advertised. In a fraud-detection context, this mismatch can cause both privacy harm and dangerous overtrust in weak signals.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documentation presents the skill as a local real-time detector, while the underlying behavior reportedly includes external Etherscan calls, queued background ingestion, and narrower heuristic detection than advertised. In a fraud-detection context, this mismatch can cause both privacy harm and dangerous overtrust in weak signals.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documentation presents the skill as a local real-time detector, while the underlying behavior reportedly includes external Etherscan calls, queued background ingestion, and narrower heuristic detection than advertised. In a fraud-detection context, this mismatch can cause both privacy harm and dangerous overtrust in weak signals.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documentation presents the skill as a local real-time detector, while the underlying behavior reportedly includes external Etherscan calls, queued background ingestion, and narrower heuristic detection than advertised. In a fraud-detection context, this mismatch can cause both privacy harm and dangerous overtrust in weak signals.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documentation presents the skill as a local real-time detector, while the underlying behavior reportedly includes external Etherscan calls, queued background ingestion, and narrower heuristic detection than advertised. In a fraud-detection context, this mismatch can cause both privacy harm and dangerous overtrust in weak signals.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The documentation presents the skill as a local real-time detector, while the underlying behavior reportedly includes external Etherscan calls, queued background ingestion, and narrower heuristic detection than advertised. In a fraud-detection context, this mismatch can cause both privacy harm and dangerous overtrust in weak signals.
Content: No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.
bash
# Check address (instant, database-only) python3 crypto_check_db.py 0x1234567890abcdef1234567890abcdef12345678

4. Run Background Sync Worker

Manual mode:

bash
python3 sync_worker.py # Runs continuously, processes queue

Batch mode:

bash
python3 sync_worker.py --max-jobs 20 # Process 20 addresses then exit

Cron schedule (recommended):

bash
# Add to crontab */10 * * * * cd ~/.openclaw/workspace/skills/crypto-scam-detector && source venv/bin/activate && ETHERSCAN_API_KEY="key" python3 sync_worker.py --max-jobs 30

💡 How It Works

Architecture Flow

text
User checks address ↓ ┌──────────────────┐ │ crypto_check_db │ ← Queries local database ONLY └────────┬─────────┘ (No external API calls) │ ↓ ┌──────────────────────┐ │ Local SQLite DB │ │ ~/.config/cr

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The submission claims or is associated with a 'No external API calls during checks' posture, yet the document explicitly advertises ChainAbuse and Etherscan lookups plus 'real-time API integration.' This kind of documentation mismatch is dangerous because reviewers and users may trust the skill as privacy-preserving or offline when it can actually transmit wallet addresses or transaction data to third parties during analysis.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script contradicts the skill's explicit security/behavior claim by performing an on-demand sync via Etherscan when an address is missing from the database. This is dangerous because users or downstream agents may rely on the 'no external API calls during checks' guarantee for privacy, determinism, offline operation, or policy compliance, but the check can unexpectedly transmit queried addresses to a third party.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill metadata and module behavior claim checks are database-only and make no external API calls, but a missing address triggers a live Etherscan sync using an API key. This creates a trust-boundary violation: user-supplied wallet addresses are transmitted externally during a check, which can leak sensitive investigation targets and violate operator expectations or policy controls.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: fastapi==0.109.0 — 1 advisory(ies): CVE-2024-24762 (FastAPI is a web framework for building APIs with Python 3.8+ based on standard )

High

Category: Supply Chain
Confidence: 95% confidence
Finding: Pinning FastAPI to a version with a known security advisory exposes any service built with this skill to framework-level compromise paths, depending on how the application uses the affected components. In a security-focused skill that may process untrusted inputs, retaining a known-vulnerable web framework materially increases attack surface and undermines trust in the service.
Content: No source excerpt is available for this finding.

Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'

High

Category: Supply Chain
Confidence: 70% confidence
Finding: Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: cryptography==42.0.5 — 11 advisory(ies): GHSA-537c-gmf6-5ccf (Vulnerable OpenSSL included in cryptography wheels); CVE-2024-12797 (Vulnerable OpenSSL included in cryptography wheels); GHSA-h4gh-qq45-vh27 (pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels) +8 more

High

Category: Supply Chain
Confidence: 97% confidence
Finding: Using cryptography==42.0.5 with multiple reported advisories, including issues related to bundled OpenSSL in wheels, can expose the application to flaws in core cryptographic operations or TLS handling. Because this skill advertises secure key storage, weaknesses in the crypto stack are especially concerning and can affect confidentiality and integrity guarantees.
Content: No source excerpt is available for this finding.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

other

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

SkillSpector

Intent-Code Divergence

Description-Behavior Mismatch

Credential Access

Intent-Code Divergence

Description-Behavior Mismatch

Self-Modification

Credential Access

Credential Access

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

Tp4

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

4. Run Background Sync Worker

💡 How It Works

Architecture Flow

Description-Behavior Mismatch

Description-Behavior Mismatch

Description-Behavior Mismatch

Known Vulnerable Dependency: fastapi==0.109.0 — 1 advisory(ies): CVE-2024-24762 (FastAPI is a web framework for building APIs with Python 3.8+ based on standard )

Possible Typosquatting: 'uvicorn' resembles popular package 'gunicorn'