Aicoin Market

• Outcome: Review
• Latest audit: May 28, 2026 at 4:40 AM UTC
• Version:
  4.0.0

Overview

This appears to be a real AiCoin market-data skill, but it needs review because it broadly handles local credentials and exposes broader analytics than its routing text suggests.

Install only if you are comfortable with this skill reading local .env files and storing an AiCoin API key in plaintext. Use a low-privilege AiCoin market-data key, avoid keeping unrelated exchange or trading credentials in .env files it can read, and treat the Hyperliquid address/trader analytics as broader than ordinary price lookup.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: The client includes a capability to persist supplied API credentials into local .env files, which exceeds a read-only market-data skill’s expected behavior and creates a durable secret-handling surface. Persisting secrets to disk can expose them to other tools, users, workspace sync, backups, or later prompt-induced misuse, especially because this skill is framed as a data-fetching utility rather than a credential manager.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Automatically reading multiple local .env files for secret management broadens the skill’s access to credentials beyond what is needed for crypto market-data retrieval. In an agent context, this creates unnecessary credential access behavior and increases the chance that unrelated secrets from the workspace or home directory are consumed or later exposed through logs, errors, or follow-on actions.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The comment claims keys are persisted to the workspace .env, but the code selects the first existing path from ENV_FILES, which includes home-directory .openclaw locations. This mismatch can cause credentials to be written to a more global location than expected, increasing accidental disclosure and violating user expectations about where secrets are stored.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The skill manifest explicitly says Hyperliquid whale/trader analytics should be handled by a different skill, yet this endpoint catalog includes extensive Hyperliquid trader, whale, account, fills, orders, PnL, and portfolio analytics. That mismatch weakens intended skill boundaries and can cause an agent to access sensitive account-level analytics through the wrong skill, increasing the chance of unauthorized data exposure, privacy violations, or policy bypass if routing relies on the manifest description.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The script exposes `key` and `set-key` commands that expand the skill from read-only market-data retrieval into credential management and access probing. In an agent-skill context, this creates unnecessary secret-handling and account-enumeration capability that is not required to answer user market queries, increasing the attack surface and the chance of credential misuse or accidental persistence.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Allowing the skill to save API credentials into `.env` gives a read-only market-data tool local secret-write capability it does not need. In an agent environment, writing secrets to disk can expose them to other tools, logs, workspace disclosure, source control accidents, or later exfiltration by unrelated code.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: `showKey` actively probes multiple endpoints to infer account entitlements and key validity, which goes beyond serving market-data responses. This can leak metadata about subscribed capabilities and valid credentials, and it provides reconnaissance functionality that is unnecessary for the declared skill purpose.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger list is extremely broad and includes generic phrases like 'check price', 'Twitter', 'trending', and similar common terms. This can cause the skill to activate outside clearly crypto-specific contexts, unnecessarily routing user requests to this tool and increasing the chance of incorrect tool selection, unintended external API calls, and leakage of user intent to a third-party service.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The function writes API credentials to disk without any warning, consent checkpoint, or disclosure at the point of write. Silent persistence of secrets is dangerous in agent environments because users may believe a one-time validation is occurring while the skill actually creates long-lived credentials on the filesystem.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The credential-saving flow persists API key material locally without an explicit warning that secrets will be stored on disk. Users may provide credentials expecting transient use, but the script writes them to `.env`, increasing the risk of accidental disclosure through files, backups, logs, or repository commits.

Credential Access

High

• Category: Privilege Escalation

Content

const __dirname = dirname(fileURLToPath(import.meta.url));

// ── .env auto-load (OpenClaw exec may not inject env into child processes) ──
const ENV_FILES = [
  resolve(process.cwd(), '.env'),
  resolve(process.env.HOME || '', '.openclaw', 'workspace', '.env'),

• Confidence: 81% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

// ── .env auto-load (OpenClaw exec may not inject env into child processes) ──
const ENV_FILES = [
  resolve(process.cwd(), '.env'),
  resolve(process.env.HOME || '', '.openclaw', 'workspace', '.env'),
  resolve(process.env.HOME || '', '.openclaw', '.env'),
];

• Confidence: 81% confidence
• Finding: .env'

Credential Access

High

• Category: Privilege Escalation

Content

// ── .env auto-load (OpenClaw exec may not inject env into child processes) ──
const ENV_FILES = [
  resolve(process.cwd(), '.env'),
  resolve(process.env.HOME || '', '.openclaw', 'workspace', '.env'),
  resolve(process.env.HOME || '', '.openclaw', '.env'),
];
for (const file of ENV_FILES) {

• Confidence: 90% confidence
• Finding: .env'

Credential Access

High

• Category: Privilege Escalation

Content

const ENV_FILES = [
  resolve(process.cwd(), '.env'),
  resolve(process.env.HOME || '', '.openclaw', 'workspace', '.env'),
  resolve(process.env.HOME || '', '.openclaw', '.env'),
];
for (const file of ENV_FILES) {
  if (!existsSync(file)) continue;

• Confidence: 78% confidence
• Finding: .env'

Credential Access

High

• Category: Privilege Escalation

Content

if ((v.startsWith('"') && v.endsWith('"')) || (v.startsWith("'") && v.endsWith("'"))) v = v.slice(1, -1);
      if (!process.env[k]) process.env[k] = v;
    }
  } catch { /* ignore unreadable .env */ }
}

const defaults = JSON.parse(readFileSync(resolve(__dirname, 'defaults.json'), 'utf-8'));

• Confidence: 74% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

return hit ? { method: hit.method, spec: hit } : null;
}

// Persist a new key pair to the workspace .env (validates before writing).
export async function saveKey(keyId, secret) {
  const headers = authHeaders(keyId, secret);
  const res = await fetch(`${BASE}/api/v3/coins/tickers?coin_key=bitcoin`, { headers, signal: AbortSignal.timeout(15000) });

• Confidence: 95% confidence
• Finding: .env

VirusTotal

VirusTotal findings are pending for this skill version.