ClawHub
Back to skill

Security audit

monero

Security checks for vulnerabilities and agentic risk

Overview

This skill clearly discloses that it controls a user-run Monero service, including wallet operations and explicit user-approved payments, but users should treat it as high-impact financial tooling.

Install only if you intentionally want an agent to operate your docker-monero instance. Keep MONERO_URL on localhost or HTTPS/private networking, do not expose tokens over plain HTTP, consider DOCKER_MONERO_READ_ONLY=true or DOCKER_MONERO_ALLOW_TRANSFERS=false unless you need sends, and pin the Docker image digest instead of relying on latest for funds-bearing deployments.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (8)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

md
permissions:
  network: "Outbound HTTP only to the user-configured MONERO_URL, a docker-monero instance the user runs. Requests carry the bearer token and can carry wallet passwords and payment destinations, so use a loopback address or an HTTPS endpoint."
  shell: "curl against MONERO_URL for ordinary use. Docker, git and openssl commands appear only in references/setup.md, for an install or check the user asked for."
  filesystem: "No filesystem access for ordinary use. Setup writes only the .env file the user asks for."
---

# monero

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 18)May include surrounding context.

bash
git clone https://github.com/psyb0t/docker-monero
cd docker-monero
cp .env.example .env
# Set DOCKER_MONERO_API_TOKEN in .env, at least 32 characters:
openssl rand -hex 32
# For the default DOCKER_MONERO_DATA_PATH=./data:

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The skill is explicitly designed to transmit sensitive data over the network to a user-supplied MONERO_URL using curl and a bearer token. Those requests may also include wallet passwords, payment destinations, and transfer instructions, so a misconfigured endpoint, non-loopback HTTP service, or attacker-controlled URL could expose credentials or enable unauthorized wallet operations.

Content

Scanner excerpt · SKILL.md (reported line 11)May include surrounding context.

md
primaryEnv: MONERO_TOKEN
    requires:
      bins:
        - curl
      env:
        - MONERO_URL
        - MONERO_TOKEN

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup.md (reported line 23)May include surrounding context.

openssl rand -hex 32

For the default DOCKER_MONERO_DATA_PATH=./data:

mkdir -p ./data sudo chown 10001:10001 ./data docker compose up -d

text

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/setup.md (reported line 34)May include surrounding context.

openssl rand -hex 32

For the default DOCKER_MONERO_DATA_PATH=./data:

mkdir -p ./data sudo chown 10001:10001 ./data docker compose up -d

text

Rp1

Medium
Category
MCP Rug Pull
Confidence
75% confidence
Finding

Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The documented docker run command uses psyb0t/monero:latest, a floating tag that can change over time and cause users to pull unexpected code. This increases supply-chain risk, especially for a wallet/node service that handles cryptocurrency operations and secrets.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation explains how to enable agent-initiated transfers via DOCKER_MONERO_MCP_ALLOW_TRANSFERS=true without an explicit warning that cryptocurrency transfers are irreversible and can move real funds. In an agent skill context, this is more dangerous because users may enable autonomous sending capability without fully understanding the financial risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.