ClawHub
Back to skill

Security audit

Crypto Daily Report (中文)

Security checks for vulnerabilities and agentic risk

Overview

This crypto reporting skill is not plainly malicious, but it needs review because it can configure recurring Telegram delivery to a fixed channel without clear confirmation or removal controls.

Install only if you intend to let the agent fetch public crypto-market content and post reports to messaging channels. Before enabling scheduling, replace the hard-coded Telegram ID with a destination you control, confirm the exact target and cadence, and make sure you know how to list and remove the cron job. Treat generated market reports as informational, not financial advice.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:38
Finding

Untrusted Remote Content Is Processed Without Prompt-Injection Controls

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 38-46
Vulnerability Type: Untrusted content processing and indirect prompt injection
Risk Level: Medium

Vulnerable Code:

bash
# 5. Get news
web_fetch "https://cointelegraph.com/rss"
web_fetch "https://tokeninsight.com/rss/news"

# 6. Get calendar
web_fetch "https://incrypted.com/en/calendar/"

Then assemble and send using message tool.

Technical Analysis

The Skill directs the agent to retrieve content from external RSS feeds and a scraped calendar page, then incorporate that content into a report sent through the message tool. It does not instruct the agent to treat remote content as untrusted data, ignore embedded instructions, restrict extraction to expected fields, or prevent fetched content from influencing subsequent tool calls.

RSS entries, article text, or calendar content could contain instruction-like text. If a source is compromised or permits attacker-controlled content, an agent may interpret that text as operational instructions rather than report data. This creates an indirect prompt-injection path.

The network requests themselves retrieve public cryptocurrency information and do not transmit local files, credentials, environment variables, private keys, or other sensitive information. No remote code execution mechanism was identified.

Attack Path

  1. An attacker publishes malicious instruction-like content through one of the fetched sources, or compromises the source.
  2. The agent retrieves the content using web_fetch.
  3. The content is placed in the agent's active context without a trust-boundary warning or structured parsing requirement.
  4. The agent may follow embedded instructions while assembling the report.
  5. The manipulated report may be sent through the message tool, or the attacker may attempt to influence other tools available in the session.

Impact Assessment

Successful exploitati ...[truncated 555 chars]

Remediation
View remediation

Remediation Suggestions

  1. Explicitly state that all fetched web and RSS content is untrusted data and must never be treated as instructions.
  2. Restrict extraction to an allowlist of fields, such as article title, canonical URL, publication time, source, and a bounded summary.
  3. Discard or escape content containing tool directives, role markers, system-style instructions, or requests to modify recipients and configuration.
  4. Require the agent to preserve the user-confirmed destination and prohibit fetched content from changing it.
  5. Require explicit user confirmation before invoking any tool beyond the tools needed to retrieve data and send the expected report.
  6. Prefer a structured RSS parser over unrestricted page ingestion and enforce content-length limits.
  7. Add source attribution and avoid presenting unverified fetched claims as authoritative financial information.

T06 · System Persistence

Warning
Location
SKILL.md:52
Finding

Persistent Scheduled Delivery Uses a Hard-Coded Telegram Destination

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 52-57
Vulnerability Type: Unsafe persistent task configuration
Risk Level: Medium

Vulnerable Code:

bash
cron add --name "crypto-daily-report" \
  --schedule "0 0 * * *" \
  --timezone "Asia/Shanghai" \
  --target "telegram:-1002009088194" \
  --command "generate-crypto-daily-report"

Technical Analysis

Scheduled report delivery is part of the Skill's declared functionality. However, the operative example contains a fixed Telegram channel identifier rather than requiring a destination supplied and confirmed by the user.

If the agent executes this example literally, it creates a recurring task that survives the current interaction and posts reports to the embedded destination. Selecting a predetermined recipient is not necessary to implement scheduled reporting and violates least-privilege destination handling.

The standalone setup-cron.sh script only prints a proposed cron command and does not itself install the task. The persistence risk arises from the directly executable cron add instruction in SKILL.md.

Attack Path

  1. A user asks the agent to configure daily report delivery but does not provide or clearly confirm a recipient.
  2. The agent follows the example in SKILL.md.
  3. The cron add command creates a persistent daily task.
  4. The task targets the hard-coded Telegram channel -1002009088194.
  5. Reports continue to be posted to that destination until the schedule is discovered and removed.

Impact Assessment

Exploitation or accidental activation can cause recurring unauthorized posting to an unintended Telegram channel. This can create spam, reputational harm, unintended disclosure of generated report content, and persistent use of the agent's messaging authority.

The current report template contains public market information rather than secrets, so the demonstrated confidentiality impact is limited ...[truncated 209 chars]

Remediation
View remediation

Remediation Suggestions

  1. Replace the fixed channel ID with a required placeholder such as ${USER_CONFIRMED_CHANNEL_ID}.
  2. Do not create a schedule unless the user explicitly supplies and confirms the destination.
  3. Display the complete destination, schedule, timezone, command, and recurrence before invoking cron add.
  4. Require a separate confirmation immediately before creating the persistent task.
  5. Validate that the destination uses an allowed channel type and an expected identifier format.
  6. Avoid default recipients in test-send.sh and documentation examples; require an explicit argument instead.
  7. Provide instructions for listing, disabling, and deleting the created task.
  8. If supported, assign an expiration date or bounded run count rather than creating indefinite persistence by default.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (16)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The declared description promises a full crypto daily briefing workflow, including report composition and outbound delivery to messaging channels. The supplied code is only a partial reference script that fetches a small subset of inputs and explicitly states that full report generation is TODO and handled elsewhere. Its primary behavior is local data collection and JSON output, not end-to-end report generation/sending. This is a material description-to-behavior mismatch.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The README instructs users to set up scheduled outbound messaging to a numeric group ID without emphasizing destination verification, consent, or the fact that messages will be sent automatically on a recurring basis. In a messaging-integrated skill, this can lead to unintended disclosure, spam to the wrong channel, or persistent automated posting if a user mistypes or misunderstands the target identifier.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file defines activation phrases, so vague-trigger review applies. The English trigger "daily report" is generic and not clearly limited to cryptocurrency context, which could cause unintended invocation when users ask for unrelated daily reports.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

"Market update" commonly refers to many markets, including stocks, macroeconomics, or local commerce, so it overlaps with everyday speech. The README does not provide exclusions or scope limits to indicate that only crypto-market requests should trigger this skill.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill invokes shell-capable commands such as curl, cron, and local scripts but does not declare any explicit tool scope or allowed-tools boundary. This increases the chance of overbroad execution permissions and makes it harder to constrain what the skill may run, especially if adapted or executed by an agent framework with permissive defaults.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger phrases include broad terms like 'daily report' and 'market update,' which can cause the skill to activate on generic user requests outside the intended crypto-reporting scope. In agent systems, overbroad activation can lead to unintended external requests, data collection, or outbound actions when the user did not specifically intend to invoke this skill.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The skill transmits data to external services, including a direct curl call to a third-party API, without documenting network restrictions, privacy considerations, or trust boundaries. External calls are not inherently unsafe, but in this context they expose execution metadata and create dependency on unverified third-party content that may be malformed, misleading, or unavailable.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md
web_search "BTC price today USD"

# 3. Get Fear & Greed Index
curl -s "https://api.alternative.me/fng/?limit=2"

# 4. Get liquidation data
web_search "crypto liquidation 24h today total amount"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill describes automated scheduled delivery to external Telegram targets without a clear warning, consent flow, or confirmation step for recurring outbound messaging. This is dangerous because it can enable unintended spam, unauthorized channel posting, or persistence through scheduled tasks that continue sending data after the initial interaction.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · data-sources.md (reported line 56)May include surrounding context.

md
- Sources: CoinGlass, Gate, CoinAnk

2. **Fallback**: Direct API (requires key)
   - CoinGlass API: `https://api.coinglass.com/...`
   - Requires authentication

### Typical Values

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The comments say BTC price comes from a web_search-based implementation, creating the impression that live market data is retrieved. In reality, the function simply returns the fixed string "69469", which contradicts the documented behavior and can mislead downstream users of the skill.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · data-sources.md (reported line 24)May include surrounding context.

md
get_fear_greed() {
    log_info "Fetching Fear & Greed Index..."
    
    local data=$(curl -s "https://api.alternative.me/fng/?limit=2" 2>/dev/null)
    
    if [ $? -ne 0 ] || [ -z "$data" ]; then
        log_warn "Failed to fetch Fear & Greed Index"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · generate-report.sh (reported line 52)May include surrounding context.

sh
get_fear_greed() {
    log_info "Fetching Fear & Greed Index..."
    
    local data=$(curl -s "https://api.alternative.me/fng/?limit=2" 2>/dev/null)
    
    if [ $? -ne 0 ] || [ -z "$data" ]; then
        log_warn "Failed to fetch Fear & Greed Index"

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest says the skill generates and sends cryptocurrency daily reports including market overview, fear & greed index, liquidation data, economic calendar, news aggregation, and channel delivery. However, the code explicitly states full report generation is not implemented and only outputs a small JSON payload with prices, BTC placeholder data, fear & greed, and a timestamp.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
78% confidence
Finding

Natural-language policy review applies to all file types. The README enforces a single documentation language for usage and operational details despite including English trigger phrases, which can create an implicit language constraint without user opt-in or an explicit region-specific justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The report template is written in Chinese and the trigger list also includes Chinese phrases, but the document does not state that the skill is intentionally Chinese-only or provide an option for another language. This can violate language/locale policy expectations when users have not opted into a fixed language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script sets TIMEZONE to Asia/Shanghai by default, which imposes a specific locale choice unless the user overrides it. The file does not indicate that this default is optional policy-wise or prompt the user to choose a locale before proceeding.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.