Security audit

ReefClaw Trading

Security checks for vulnerabilities and agentic risk

Overview

This trading integration needs review because automatic updates can reset saved conversation references, and its promised trading protection has an undocumented exception.

Ask the publisher to preserve session records on errors and clarify when exchange-native stops can be disabled. Use a dedicated trading agent, back up its session files, and remain in paper mode while reviewing these issues. Positions, balances, trades, and heartbeat details are shared with ReefClaw.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · skills/reefclaw/SKILL.md (reported line 124)May include surrounding context.
md
user runs the line themselves. **The user can also install it from ClawHub by hand** (OpenClaw 2026.8.1 or newer): OpenClaw's Control UI (Plugins → Discover → search "reefclaw" → Install → accept the listed capabilities), or the chat command `/plugins install clawhub:@reefclaw/openclaw-plugin` followed, after reading the capability list it replies with, by the same command plus `--accept-capabilities` (the chat command needs `commands.plugins: true` in openclaw.json, which only the user sets). ClawHub scans every release with an automated security reviewer; the current release passes it (no warning at install). If a newer release ever shows a "Review" label, OpenClaw 2026.8.1+ shows the audit and continues once the capabilities are accepted, while OpenClaw 2026.7.x may block the chat command on it — there the user runs the `npx` line above. Whatever the install path, **save the connection settings anyway** — the connector picks them up automatically the moment the plugin is running.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: bridge/providers/connector-update-direct.js:180
Evidence: child = spawn(npx, args, { cwd, env, stdio: ['ignore', 'pipe', 'pipe'], shell: false });