ClawHub
Back to skill

Security audit

Defipoly

Security checks for vulnerabilities and agentic risk

Overview

This is a real Defipoly automation skill, but it gives an agent risky wallet and transaction-signing powers that need review before installation.

Install only if you are comfortable giving an agent access to a funded Solana wallet and letting it submit irreversible transactions. Use a new low-value wallet, avoid importing an existing wallet or pasting private keys, do not let it search your filesystem for wallet files, and treat the backend transaction-signing flow as high trust in the Defipoly service.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/agent-play.js:174
Finding

Blind Signing of Backend-Controlled Solana Transactions

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:244
Finding

Overbroad Wallet Discovery and Private-Key Extraction Instructions

Content
View full analysis
... 3. Show the user which wallets have DPOLY tokens and SOL 4. If a wallet has DPOLY, ask the user if they want to use it 5. Import the chosen wallet: `node {skillDir}/scripts/agent-play.js setup ` ``` ### Technical Analysis The Skill directs the agent to search the host for wallet files, including unspecified JSON files in project directories. This exceeds the minimum access required to play the game. Project JSON files may contain unrelated credentials, API tokens, application configuration, or private keys. The flow also directs the agent to extract and pass a private key rather than using an explicitly approved wallet file. Although public-key balance checks are legitimate, broad filesystem discovery and private-key extraction are not necessary to perform them. ### Attack Path 1. The user chooses to use an existing wallet. 2. The agent follows the Skill instructions and searches default locations and project directories for JSON files. 3. The agent opens candidate files to determine whether they contain wallet material. 4. This inspection exposes unrelated secrets or identifies a high-value wallet. 5. The selected private key is extracted and supplied to the setup command. 6. The key may consequently appear in command history, process arguments, execution logs, or retained agent context. ### Impact Ass ...[truncated 351 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/agent-play.js:335
Finding

Plaintext Private-Key Storage and Command-Line Secret Exposure

Content
View full analysis
`. 2. The private key becomes part of the process command line and potentially part of shell or agent logs. 3. A local process, system administrator, monitoring service, or log reader captures the argument. 4. Alternatively, the generated plaintext `.wallet.json` is created with permissions that allow unintended local access or at a manipulated filesystem target. 5. The attacker reconstructs the keypair from the captured bytes or base58 string. 6. The attacker signs arbitrar ...[truncated 368 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/agent-play.js:58
Finding

Predictable Plaintext JWT Cache in Shared Temporary Directory

Content
View full analysis
data.expiresAt - 5 * 60 * 1000) return null; return data.token; } catch { return null; } } function saveCachedToken(wallet, token) { const data = { token, wallet, expiresAt: Date.now() + 23 * 60 * 60 * 1000, // 23h (conservative) }; writeFileSync(tokenCachePath(wallet), JSON.stringify(data)); } ``` ### Technical Analysis The authentication bearer token is cached in `/tmp` under a path deterministically derived from the public wallet address. Public wallet addresses are not secret, so another local user can calculate the filename. The cache is written without explicit restrictive permissions, exclusive creation, ownership checks, or symbolic-link checks. Shared temporary directories are generally attacker-influenced environments. The token is also retained for approximately 23 hours, increasing the replay window. The flagged transmission at `scripts/agent-play.js:159` and `scripts/agent-play.js:165` sends this token in the `Authorization` header to the configured backend. Authentication requires such transmission, but theft of the cached bearer token allows it to be replayed during its validity period. ### Attack Path 1. An attacker learns or observes the victim's public wallet address. 2. The attacker computes the first 12 hexadecimal characters of its SHA-256 h ...[truncated 843 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (22)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared purpose is game automation, but the instructions also cover generating/importing private wallets, caching auth artifacts, and scanning arbitrary wallet addresses and balances. That behavioral expansion materially increases sensitive-data handling and surveillance capability beyond what a user would reasonably infer from the description, creating a trust and consent gap around keys, tokens, and wallet discovery.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill promotes autonomous on-chain actions using a funded wallet without a prominent upfront warning that transactions spend real assets and are irreversible. In the context of blockchain operations, missing this warning is especially dangerous because users may not appreciate that the agent can incur fees, transfer value, and perform risky game actions like steals automatically.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: defipoly
description: "Play Defipoly — a Monopoly-inspired DeFi game on Solana. Buy properties, earn daily DPOLY yield, shield against theft, steal from players and the bank, roll dice for bonuses. Your agent plays autonomously with a funded SOL wallet."
version: 1.0.0
user-invocable: true
homepage: https://defipoly.app
metadata: {"openclaw":{"emoji":"🎲","os":["darwin","linux","win32"],"requires":{"bins":["node","npm"]},"skillKey":"defipoly","install":[{"id":"deps","kind":"exec","command":"cd {skillDir} && npm install","label":"Install Defipoly agent dependencies"}]}}
---

# Defipoly Game Agent

Y

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The setup flow combines wallet discovery and private-key import without a strong safety warning about secret handling or consent boundaries. In context, this is particularly dangerous because it normalizes exposing wallet credentials to an autonomous agent that can immediately use them for live blockchain transactions.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

These instructions create a natural-language path for the agent to locate local wallet files and then import their secret material for use. Because Solana wallet files and base58 private keys directly control funds, this can lead to credential exfiltration, unauthorized account access, and irreversible theft of real assets if the agent or surrounding tooling is compromised or over-privileged.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High
Category
Supply Chain
Confidence
92% confidence
Finding

The lockfile includes ws 8.19.0, which is flagged for memory disclosure and memory-exhaustion denial of service issues. Even as a transitive dependency, a network-facing Solana agent may process untrusted websocket traffic from RPC infrastructure, so a vulnerable ws version can expose the process to crashes or unintended data exposure.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==7.5.10 — 1 advisory(ies): CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High
Category
Supply Chain
Confidence
90% confidence
Finding

The lockfile also includes ws 7.5.10, which is flagged for memory exhaustion from tiny fragments and data chunks. Because this agent is designed to operate autonomously with a funded wallet and maintain blockchain network connectivity, denial of service against its websocket handling could disrupt operation or create availability gaps at financially sensitive times.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script blindly signs a backend-provided serialized transaction and submits it for every state-changing action without independently validating transaction contents or prompting for confirmation. Because the skill is designed to operate with a funded SOL wallet, a compromised or malicious backend could craft arbitrary transactions that drain assets or grant unintended approvals.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill declares no explicit tool or permission scope even though its documented behavior clearly requires filesystem access, environment-variable access, network access, and command execution. In an agent setting, this increases the chance the skill is invoked with overly broad capabilities, making accidental credential access or unintended external calls more likely.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
99% confidence
Finding

The setup flow instructs the agent to search outside the skill directory for wallet files, including default Solana locations and other project directories. This is dangerous because it authorizes broad filesystem discovery of highly sensitive credential material unrelated to the game, creating a direct path to privacy violations and wallet compromise.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The documentation explicitly instructs importing an existing wallet by handling a base58 private key. Direct agent handling of raw private keys is highly sensitive and creates unnecessary exposure risk through logs, prompts, shell history, process lists, or accidental persistence.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
86% confidence
Finding

The skill instructs the agent not to ask permission for routine moves, enabling autonomous decision-making with a funded wallet. In this specific context, autonomous execution is security-relevant because each move can spend fees, alter asset positions, or attempt risky actions against players, all without fresh user approval.

Content

Scanner excerpt · SKILL.md (reported line 342)May include surrounding context.

md
- Do NOT make more than 3 actions per check-in unless the user explicitly asks for a burst
- Do NOT stay silent — if you're checking in and nothing is available, still tell the user
- Do NOT ask permission for routine moves — your play style is your mandate
- Do NOT change play style without asking the user

## Important Notes

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The authenticate flow requests a nonce, signs it with the wallet secret key locally, then POSTs the wallet address, nonce, and signature to the backend. While the signing message mentions authentication, the CLI itself does not provide a user-facing disclosure that wallet-linked authentication data will be transmitted and cached.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The setup flow writes the wallet secret key to .wallet.json in plaintext without warning the user about local credential storage or applying file-permission hardening. Any local compromise, backup leak, shared workspace access, or accidental commit of the file can expose the private key and lead to total wallet loss.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script exposes a generic scan-wallets command that accepts arbitrary wallet addresses and enumerates SOL/DPOLY balances in bulk. While it uses public on-chain data, this capability is broader than necessary for autonomous Defipoly gameplay and can facilitate targeting, profiling, or operational reconnaissance of third-party wallets.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
87% confidence
Finding

The markdown defines activation around the user saying "play defipoly," but it does not provide negative examples or clarify when this should trigger versus ordinary discussion about the game. This can lead to unintended invocation from casual conversation rather than an explicit request to start autonomous play.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: stream-json==1.9.1 — 1 advisory(ies): CVE-2026-71429 (stream-json: pick/ignore/filter/replace filters are O(depth²) on nested input — )

Low
Category
Supply Chain
Confidence
75% confidence
Finding

The lockfile includes stream-json 1.9.1 with an advisory describing O(depth^2) behavior on deeply nested input, which can enable algorithmic complexity denial of service. In this package it is only a transitive dependency of jayson, so exploitability depends on whether the agent parses attacker-controlled deeply nested JSON through that path.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: uuid==8.3.2 — 1 advisory(ies): CVE-2026-41907 (uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided)

Low
Category
Supply Chain
Confidence
63% confidence
Finding

uuid 8.3.2 is flagged for missing bounds checks in certain hash-based UUID functions when a caller supplies a buffer. This is likely lower risk here because it is a transitive library and exploitation requires the application path to invoke vulnerable UUID APIs with attacker-influenced buffer arguments.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 7)May include surrounding context.

json
"private": true,
  "type": "module",
  "dependencies": {
    "@solana/web3.js": "^1.98.0",
    "bs58": "^6.0.0",
    "tweetnacl": "^1.0.3"
  }

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 8)May include surrounding context.

json
"type": "module",
  "dependencies": {
    "@solana/web3.js": "^1.98.0",
    "bs58": "^6.0.0",
    "tweetnacl": "^1.0.3"
  }
}

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 9)May include surrounding context.

json
"dependencies": {
    "@solana/web3.js": "^1.98.0",
    "bs58": "^6.0.0",
    "tweetnacl": "^1.0.3"
  }
}

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The balance command allows querying any provided wallet address rather than only the configured gameplay wallet. Although this reads public blockchain state and is lower risk than direct fund movement, it still expands the tool into a generic wallet-inspection utility outside the stated gameplay scope.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/agent-play.js:19