ClawHub
Back to skill

Security audit

FairScale Solana

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real wallet-reputation skill, but it has under-scoped paid requests, broad natural-language activation, and sensitive wallet/API-key handling that users should review before installing.

Install only if you are comfortable sending wallet addresses, transaction amounts, custom rules, and wallet lists to FairScale. Do not enable automatic wallet payments without explicit spend limits or confirmation, and avoid using the helper script with a real API key on the command line; prefer a protected environment variable or secret store.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
README.md:23
Finding

Unpinned Remote Installers May Execute Unreviewed Code

Content
View full analysis

Vulnerability Details

File Location: README.md, lines 23-32
Vulnerability Type: Supply-chain risk from mutable, unpinned remote installation tools and sources
Risk Level: Medium

Vulnerable Code

bash
### ClawHub

```bash
npx clawhub@latest install fairscale-solana

GitHub

bash
npx skills add RisheeA/fairscale-solana-skill
text

### Technical Analysis

The documented installation methods invoke remotely resolved npm tooling without pinning the tools or installed content to immutable versions. In particular, `clawhub@latest` is a mutable release tag. The GitHub-based command also identifies a repository without an immutable commit hash.

These commands can therefore retrieve and execute content that differs from the files covered by this audit. If an npm account, package, repository, maintainer account, or publication pipeline is compromised, the installation commands could deliver attacker-controlled code. This is a supply-chain weakness; the reviewed repository itself contains no confirmed malicious payload.

### Attack Path

1. An attacker compromises one of the referenced npm packages, its publisher, the source repository, or its release pipeline.
2. The attacker publishes a malicious version under the mutable `latest` tag or modifies remotely resolved repository content.
3. A user follows the installation instructions.
4. `npx` downloads and executes the changed installer or installs changed skill content.
5. The malicious process runs with the permissions of the user performing the installation.

### Impact Assessment

Successful exploitation could permit arbitrary code execution under the installing user's account. Depending on that account's privileges and environment, the attacker could access user-readable credentials and files, alter local configuration, install persistent components, or compromise the agent environment. No privilege escalation beyond the invoking 
...[truncated 65 chars]
Remediation
View remediation

Remediation Suggestions

  • Replace @latest with a reviewed, exact package version.
  • Pin repository installation to a specific audited commit hash or signed release.
  • Publish and verify cryptographic integrity hashes or signatures.
  • Use lockfiles where supported and verify package provenance.
  • Document a controlled dependency-review and update process.
  • Advise users to inspect the resolved package and repository provenance before execution.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/check_wallet.sh:1
Finding

API Key Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: scripts/check_wallet.sh, lines 1-15
Vulnerability Type: Sensitive credential exposure through process arguments and command history
Risk Level: Medium

Vulnerable Code

bash
#!/bin/bash
# FairScale Wallet Check Script
# Usage: ./check_wallet.sh <WALLET_ADDRESS> <API_KEY>

WALLET=$1
API_KEY=$2

if [ -z "$WALLET" ] || [ -z "$API_KEY" ]; then
  echo "Usage: ./check_wallet.sh <WALLET_ADDRESS> <API_KEY>"
  exit 1
fi

curl -s "https://api2.fairscale.xyz/score?wallet=$WALLET" \
  -H "accept: application/json" \
  -H "fairkey: $API_KEY" | jq .

Technical Analysis

The script requires the FairScale API key as its second command-line argument. Command-line secrets may be exposed through shell history, process listings, audit systems, terminal session capture, debugging output, orchestration metadata, or automation logs.

The script sends the key to the documented HTTPS API as a header and does not contain evidence of intentional exfiltration. Nevertheless, accepting the credential through an observable process argument unnecessarily broadens local exposure.

Attack Path

  1. A user invokes the script with a real key, for example: ./check_wallet.sh WALLET_ADDRESS SECRET_API_KEY.
  2. The command or process arguments are captured in shell history, process-monitoring output, audit logs, CI telemetry, or session recordings.
  3. A local user or operator with access to that data retrieves the API key.
  4. The observer reuses the key against the FairScale API.

Impact Assessment

An attacker who obtains the key may consume the associated API quota and invoke any API functionality authorized for that credential. The exact account-level scope depends on server-side permissions not present in this project. The finding does not demonstrate operating-system privilege escalation or exposure of unrelated credentials.

Remediation
View remediation

Remediation Suggestions

  • Read the key from a protected environment variable such as FAIRSCALE_API_KEY rather than a positional argument.
  • For interactive use, optionally read the credential without echoing:
    bash
    read -r -s -p "FairScale API key: " API_KEY
printf '\n'
  • Prefer an operating-system credential store or narrowly permissioned configuration file for persistent storage.
  • Ensure CI and automation systems inject the secret through masked secret facilities.
  • Avoid printing the key and disable tracing around credential handling.
  • Validate that the variable is set, and document secure key rotation if accidental disclosure occurs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (14)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 9)May include surrounding context.

md
| Method | Best For | Setup |
|--------|----------|-------|
| **API Key** | Most users | Get key from sales.fairscale.xyz |
| **x402 Payments** | Agents with wallets | No setup, pay $0.05/call |

## Features

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The description says users can 'Ask anything in plain English' with examples like 'is this a bot?' and 'whale?', which are broad phrases that can overlap with normal conversation. In agent environments, ambiguous triggers can cause the skill to activate unexpectedly and send wallet-related queries to external services without clear user intent.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The README instructs users to run npx clawhub@latest install fairscale-solana, which fetches and executes code at install time from a moving target rather than a fixed, reviewed version. If the upstream package is compromised or a breaking release is published, users may execute unintended code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The README also uses npx skills add RisheeA/fairscale-solana-skill without pinning the package/tool version, again causing execution of whatever version is current at the time of install. This creates a supply-chain risk because an attacker who compromises the package or distribution path could deliver malicious code to users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The x402 payment option states that 'No setup needed' and that the agent can 'pay per request automatically,' but it does not prominently warn that this may spend funds from the agent's Solana wallet. In an autonomous or semi-autonomous agent context, lack of explicit spend warnings can lead to unexpected financial loss through accidental or repeated invocations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The usage section includes short standalone prompts like 'Is this a bot?', 'Is this a whale?', and 'Diamond hands?' without clear scoping. In a conversational agent, these generic phrases increase the chance of accidental invocation, unintended data disclosure, or unexpected paid API usage.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This endpoint sends a wallet address to an external reputation service, creating data exposure to a third party. In the context of agent-driven financial decisions, repeated lookups can reveal user interests, counterparties, and timing patterns that may be sensitive even if the wallet is publicly visible on-chain.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

Pro tier: 10,000 calls/day

text
GET https://api.fairscale.xyz/score?wallet=ADDRESS

Response:

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

The /check endpoint transmits both wallet address and transaction amount to an external API, exposing not only the counterparty but also the contemplated value of a transaction. That combination is more sensitive than a simple reputation lookup because it can reveal trading intent and financial behavior.

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

Free tier: 100 calls/day

text
GET https://api.fairscale.xyz/check?wallet=ADDRESS&amount=500

Response:

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The custom scoring endpoint sends wallet data plus potentially detailed screening criteria to a third party, which can disclose internal risk policies or business logic. This may expose operational preferences and allow external profiling of how the agent evaluates counterparties.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

Apply custom scoring rules. Pro tier required.

text
POST https://api.fairscale.xyz/score/custom
Content-Type: application/json

{

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The batch endpoint enables bulk transmission of wallet lists to a third party, increasing privacy and data-handling risk due to the volume and possible sensitivity of the dataset. In contexts like airdrops, whitelists, or access control, such lists may represent valuable internal targeting or user segmentation information.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

Score multiple wallets at once. Pro tier required.

text
POST https://api.fairscale.xyz/batch
Content-Type: application/json

{

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The registration flow sends the user's wallet address to a third-party service without accompanying privacy guidance. While necessary for account creation, it still constitutes external transmission of user-associated identity data and should be clearly disclosed.

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

Get an API key:

text
POST https://api.fairscale.xyz/register
{ "wallet": "your_solana_wallet" }

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The upgrade flow transmits API key, subscription tier, and payment transaction signature to an external service, which are sensitive account and billing-related artifacts. Exposure or mishandling of these values could affect account security, billing privacy, or service access.

Content

Scanner excerpt · SKILL.md (reported line 197)May include surrounding context.

For higher limits and custom scoring:

text
POST https://api.fairscale.xyz/upgrade
{
  "api_key": "fs_your_key",
  "tier": "pro",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script requires the API key to be passed as a positional command-line argument, which can expose the secret through shell history, process listings, audit logs, and CI/job runners. Because this is a wallet-scoring utility likely used in shared developer or automation environments, the risk of accidental credential disclosure is real even though the script does not explicitly print the key.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill instructs agents to send wallet addresses and transaction amounts to a third-party API without any privacy disclosure or warning. Even if wallet addresses are public on-chain, linking them to user intent, risk decisions, or contemplated transaction amounts creates additional metadata exposure that users may not expect.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.