ClawHub
Back to skill

Security audit

Cortex Protocol

Security checks for vulnerabilities and agentic risk

Overview

The skill is for agent identity registration and mostly matches that purpose, but it handles wallet credentials and public identity registration in ways users should review carefully.

Install only if you are comfortable registering an agent identity through Cortex Protocol and Base. Provide your own securely managed controller address, avoid the wallet-generation path that prints a private key, use a non-sensitive explicit agent name instead of a host-derived default, and inspect the registration payload before sending it.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
register.sh:29
Finding

Generated Controller Private Key Is Exposed in Standard Output

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
register.sh:21
Finding

Unpinned Global Installation of a Wallet-Handling Dependency Is Recommended

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
register.sh:45
Finding

Unescaped User Input Is Interpolated into the Registration JSON Payload

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill includes shell commands that perform network actions and wallet-related operations, but it does not declare any tool scope or allowed-tools metadata. In an agent ecosystem, this weakens reviewability and can cause users or orchestrators to permit broader execution than intended, increasing the chance of unintended command execution and data egress.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

Register your agent with a single API call:

bash
curl -X POST https://cortexprotocol.co/api/register \
  -H "Content-Type: application/json" \
  -d '{
    "name": "YourAgentName",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill instructs users to generate a wallet and print the private key directly to stdout with no warning or secure handling guidance. Private keys shown in terminals, logs, transcripts, agent output, or telemetry can be copied by other processes or retained in history, leading to permanent compromise of the wallet and any assets or identity tied to it.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

bash
# Check your agent exists
curl -s "https://mainnet.base.org" \
  -X POST -H "Content-Type: application/json" \
  -d '{"method":"eth_call","params":[{"to":"0xfBDe0b0C21A46FC4189F72279c6c629d1b80554A","data":"0x..."},"latest"],"id":1,"jsonrpc":"2.0"}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

The script transmits user-supplied agent metadata and the controller address to an external service without any validation, trust verification, or clear disclosure beyond the API URL. In this skill’s context, that is security-relevant because it causes on-chain identity registration through a third-party endpoint and may expose sensitive operational metadata or bind an identity to an unintended controller if inputs are manipulated.

Content

Scanner excerpt · register.sh (reported line 47)May include surrounding context.

sh
echo "   Controller: $CONTROLLER"
echo ""

RESPONSE=$(curl -s -X POST "$API" \
  -H "Content-Type: application/json" \
  -d "{
    \"name\": \"$NAME\",

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The registration script sends host-derived identity data, including a hostname-based name and controller address, to a third-party API without warning about disclosure or consent. This can leak infrastructure naming conventions and link an agent or environment to a public on-chain identity, creating unnecessary privacy and attribution risks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.