ShieldBot BNB Chain Security Scanner

• Outcome: Pass
• Latest audit: Sep 14, 2026 · 11:49 PM UTC
• Version: 1.0.1

Overview

This skill is a disclosed ShieldBot API client for blockchain security checks, with privacy and supply-chain cautions but no artifact-backed malicious behavior.

Install in an isolated environment and prefer pinned package versions. Do not submit private keys, seed phrases, confidential trading plans, unreleased transaction calldata, or sensitive personal details; wallet addresses, URLs, transaction fields, and chat questions are sent to ShieldBot or the configured API endpoint.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:8

Finding

Mutable and Unverified Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Locations:

• README.md:8
• README.md:14
• SKILL.md:144-148
• requirements.txt:1

Vulnerability Type: Unsafe dependency installation and insufficient dependency pinning
Risk Level: Medium

Vulnerable Code

README.md:8

bash

npx clawhub@latest install shieldbot-security

README.md:14

bash

cd ~/.openclaw/skills/shieldbot-security && pip install -r requirements.txt

SKILL.md:144-148

bash

pip install -r "{baseDir}/requirements.txt"

requirements.txt:1

text

requests>=2.31.0,<3.0.0

Technical Analysis

The documented installation procedure directs users to execute the mutable latest release of the clawhub package through npx. This does not guarantee that the package executed during installation is the same version that was reviewed during this audit.

The Python dependency is also specified as a broad compatible version range rather than an exact, integrity-verified release. A future requests release satisfying this range can therefore be installed without further review. No lockfile or cryptographic package hashes are provided.

These practices create a supply-chain trust dependency on package registries, publisher accounts, and all future releases matching the constraints. Although no malicious dependency was found in the reviewed project, the effective installation payload can change after the audit.

Attack Path

1. An attacker compromises a relevant package publisher account, package registry, or future compatible release.
2. The attacker publishes a malicious clawhub version as latest, or a malicious dependency version satisfying requests>=2.31.0,<3.0.0.
3. A user follows the documented installation instructions.
4. npx retrieves and executes the mutable package, or pip resolves and installs the unreviewed compatible dependency.

...[truncated 718 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace npx clawhub@latest with an exact, reviewed version:

   bash

   npx clawhub@X.Y.Z install shieldbot-security
   

2. Pin Python dependencies to exact reviewed versions:

   text

   requests==2.32.5
   

3. Generate and commit a lockfile containing all transitive dependency versions.

4. Add cryptographic hashes and install with hash verification:

   bash

   pip install --require-hashes -r requirements.txt
   

5. Review and update pinned dependencies through a controlled process with automated vulnerability scanning and test coverage.

6. Run package installation as an unprivileged user in an isolated environment, such as a dedicated virtual environment or container.

7. Where supported, verify package provenance, registry signatures, and publisher identity before installation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (16)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The README instructs users to run npx clawhub@latest install shieldbot-security, which fetches and executes the latest published package version at install time. This creates a supply-chain risk: if the upstream package is compromised or a breaking/malicious version is published, users may execute unreviewed code immediately. In a security-oriented skill, encouraging unpinned remote execution is especially risky because users are likely to trust the tool's installation instructions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README advertises actions such as scanning contracts, simulating transactions, checking URLs, investigating deployers, and asking free-form questions, but does not clearly warn that user-provided inputs will be transmitted to the ShieldBot third-party API. This can lead users to unknowingly send sensitive wallet addresses, contract data, transaction details, URLs, or investigative queries off-platform, creating privacy and data-handling risks. The skill context increases the concern because the data involved is security-sensitive and may reveal user intent, holdings, or unreleased transaction activity.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill declares executable behavior that uses Python, network access, and environment-based configuration, but it does not declare an explicit tool scope such as permissions or allowed-tools. That weakens least-privilege controls and makes it harder for a host agent or reviewer to constrain what the skill is allowed to access, especially since the API base can be overridden via an environment variable.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger list includes broad, common terms such as 'scan', 'simulate', 'threats', and 'check url', which can cause the skill to activate in conversations where the user did not clearly intend to invoke it. Because activation leads to command execution and outbound API requests, accidental triggering can expose user-supplied addresses, URLs, or transaction details to the external service.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Defining the 'ask' command as applicable to 'any DeFi security question' creates unclear invocation boundaries and can route broad user prompts to an external AI-backed API without sufficiently explicit consent. In this skill's context, that is more sensitive because free-text questions may contain wallet details, URLs, or transaction context that the user did not realize would be transmitted off-platform.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The firewall endpoint documentation instructs users to submit raw transaction calldata, destination address, optional sender address, and value to a third-party remote service, but it does not warn that this can expose sensitive transaction intent and wallet linkage data. In a blockchain security tool, users may paste pre-signing transactions they consider private; lack of disclosure can lead to unintended sharing of trading behavior, wallet identity, or high-value pending actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The rescue endpoint requires a wallet address and returns detailed approval, spender, and value-at-risk analysis, implying server-side inspection of a user's asset relationships and exposure profile. Without a privacy warning, users are not clearly informed that their wallet activity and approval graph are being sent to and analyzed by a remote service, which can reveal portfolio and security posture information.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The conversational agent endpoint accepts free-form user messages and an optional session identifier, but the documentation does not warn that both are sent to a remote AI-backed service and may be retained for conversation history. Users may include wallet addresses, token plans, phishing URLs, or other sensitive operational details in messages, creating privacy and profiling risk if disclosure is not made explicit.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/chains.json (reported line 7)May include surrounding context.

json

"chainId": 56,
    "nativeToken": "BNB",
    "explorer": "https://bscscan.com",
    "explorerApi": "https://api.bscscan.com/api",
    "rpcUrl": "https://bsc-dataseed.binance.org",
    "isDefault": true
  },

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/chains.json (reported line 16)May include surrounding context.

json

"chainId": 1,
    "nativeToken": "ETH",
    "explorer": "https://etherscan.io",
    "explorerApi": "https://api.etherscan.io/api",
    "rpcUrl": "https://eth.llamarpc.com"
  },
  {

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/chains.json (reported line 24)May include surrounding context.

json

"chainId": 8453,
    "nativeToken": "ETH",
    "explorer": "https://basescan.org",
    "explorerApi": "https://api.basescan.org/api",
    "rpcUrl": "https://mainnet.base.org"
  },
  {

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/chains.json (reported line 32)May include surrounding context.

json

"chainId": 42161,
    "nativeToken": "ETH",
    "explorer": "https://arbiscan.io",
    "explorerApi": "https://api.arbiscan.io/api",
    "rpcUrl": "https://arb1.arbitrum.io/rpc"
  },
  {

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/chains.json (reported line 40)May include surrounding context.

json

"chainId": 137,
    "nativeToken": "MATIC",
    "explorer": "https://polygonscan.com",
    "explorerApi": "https://api.polygonscan.com/api",
    "rpcUrl": "https://polygon-rpc.com"
  },
  {

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The generic request helper sends user-supplied transaction simulation fields, phishing URLs, wallet addresses, and free-form chat content to a third-party API without any explicit disclosure or consent mechanism. In a security-analysis context, this is especially sensitive because submitted data may include unreleased contracts, investigation targets, wallet relationships, suspicious URLs, or operational details that users may not expect to leave the local environment.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The client exposes an ask action that sends arbitrary user messages to /api/agent/chat, which expands the skill from a narrowly described scanner/auditor into a general AI-advisor capability not reflected in the metadata. Hidden or under-disclosed capabilities are dangerous because they change the trust boundary: users may provide sensitive security, wallet, or investigation data believing the tool only performs deterministic scanning, while the skill actually forwards free-form prompts to a remote model-backed service.

Content

No source excerpt is available for this finding.

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency is specified as requests>=2.31.0,<3.0.0, which allows installation of multiple future or historical 2.x releases without guaranteeing a known-safe version. Because requests has documented advisories and this skill performs security-sensitive network operations against blockchain and phishing-analysis APIs, leaving the version range broad increases the chance of pulling a vulnerable release during installation or rebuilds.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.