ClawHub
Back to skill

Security audit

Happy Thoughts

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its stated payment-based AI marketplace purpose, but it exposes agent-callable flows that can send prompts and wallet data to a live service and lead to real USDC payment activity without enough built-in consent or scope guidance.

Install only if you intend agents to call a live third-party AI marketplace. Require explicit user confirmation before any x402 payment, provider registration, bundle purchase, feedback, or dispute, and do not send secrets, private keys, regulated data, or sensitive internal context in prompts or callback flows.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (17)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared purpose centers on submitting prompts to /think for routed AI second opinions. The actual code chunk demonstrates a different primary function: purchasing prepaid bundles via /bundle. While both may belong to the same broader service and both reference payment handling, this code does not perform the advertised core behavior of sending a prompt and receiving a specialized response. Therefore the description does not accurately represent this specific code chunk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared purpose emphasizes a transactional second-opinion API where agents POST prompts to /think, include payment-related wallet information, and receive routed specialized responses with x402 payment flow. The supplied code instead only wraps informational GET endpoints for browsing providers, previewing routing, and viewing public scores. These are related to the same product domain, but they are materially different from the stated primary purpose and omit the core paid thinking functionality entirely. Therefore the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The declared description presents the skill as a transactional second-opinion service centered on submitting prompts to /think, routing them to providers, and handling blockchain-based payments and payouts. The supplied code instead is an example agent/client that exposes two read-only tools: discover providers and preview route, backed by GET requests to /discover and /route. It never sends a thought/prompt to a provider service endpoint, never includes a buyer wallet, never performs payment or payout logic, and never demonstrates Happy Trail pricing behavior beyond route preview. This is a materially different primary behavior from the declared purpose, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The /think API accepts a free-form prompt, wallet address, and optional callback URL, while the product description states prompts are routed to external providers; however, the spec does not clearly warn that submitted content and identifying/payment metadata may be disclosed to third parties and callback destinations. This is dangerous because agents may forward sensitive user data, internal context, or financial identifiers off-platform without informed consent, creating privacy, confidentiality, and compliance risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 28)May include surrounding context.

Health

bash
curl https://happythoughts.proteeninjector.workers.dev/health

Example response:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README documents paid /think and /register flows and even provides copy-paste examples, but it does not prominently warn users that requests can trigger real on-chain USDC payments or staking requirements. In an agent-to-agent setting, operators may run examples or integrate the endpoint assuming it is informational, leading to unintended financial loss or automated spending.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The README advertises async operation with a user-supplied callback_url but gives no warning that prompts, outputs, metadata, or billing-related context may be transmitted to an external URL. This creates privacy and integrity risk because integrators may unknowingly exfiltrate sensitive model inputs/outputs or expose themselves to SSRF-style misuse if callback destinations are not tightly controlled.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
80% confidence
Finding

The skill advertises network-capable behavior via curl and remote HTTP endpoints but does not declare an explicit tool scope such as allowed-tools or permissions. That omission weakens policy enforcement and user visibility, increasing the chance an agent can make unintended outbound requests or shell-assisted network calls under a vague trust model.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

The skill is designed to send prompts and wallet-related data to an external service, which creates an inherent data exfiltration and privacy boundary. In this context the transmission is intentional, but it is still security-relevant because prompts may contain sensitive decision-making data and wallet identifiers tied to payment activity.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md
openclaw:
    requires:
      bins:
        - curl
    emoji: "🧠"
    homepage: https://happythoughts.proteeninjector.workers.dev
tags:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Although the skill mentions x402 and HTTP 402 responses, it does not present a prominent, plain-language warning that invoking paid endpoints can trigger real on-chain payment activity on Base mainnet. In an agent context, insufficient payment-risk disclosure can lead to unintended financial transactions, especially if downstream automation retries or auto-completes payment flows.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest describes a skill centered on POST /think for pay-per-thought routed responses, but this file implements a separate /bundle purchase flow for prepaid tiers like starter, builder, pro, and whale. Selling prepaid bundles is a materially different capability from requesting a single routed second opinion, so the code behavior exceeds the manifest's stated scope.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
80% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · examples/bundle_example.py (reported line 21)May include surrounding context.

python
if locked_specialty:
        payload["locked_specialty"] = locked_specialty

    response = requests.post(f"{BASE}/bundle", json=payload, timeout=30)
    response.raise_for_status()
    return response.json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · examples/curl.sh (reported line 7)May include surrounding context.

sh
BASE="https://happythoughts.proteeninjector.workers.dev"

# Health
curl "$BASE/health"
echo

echo "\n# Discover providers"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This shell script sends user-supplied content, including a trading prompt and buyer wallet address, to an external endpoint via curl. Although the script labels the action as a purchase attempt, it does not clearly disclose the privacy implication that this data is transmitted to a third-party service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The registration request transmits provider identity details, specialties, and a payout wallet address to an external server. The script notes that payment is required, but it does not warn the user that potentially sensitive profile and wallet information is being disclosed over the network.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This POST request sends a buyer wallet address to an external service as part of a purchase action. While the script mentions payment, it does not provide a clear warning that identifying wallet data will be transmitted off-system.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The manifest markets the skill as a general-purpose prompt-routing marketplace ('across any domain') and marks it agent-callable, but it does not define any trigger boundaries, safe-use scope, or exclusions for sensitive domains. In an agent setting, this increases the chance that arbitrary user prompts, secrets, regulated-content requests, or high-risk decision requests are automatically routed to third-party providers without contextual safeguards.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.