ClawHub
Back to skill

Security audit

knowbster

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent crypto marketplace integration, but it can use wallet private keys to spend real ETH and upload content to persistent external storage without enough scoping or warnings.

Review before installing. Use a low-value or test wallet, avoid exposing a funded private key to the agent process, require explicit approval for every transaction, and do not upload secrets, personal data, or proprietary content to IPFS/Pinata. Prefer pinned install commands and locked dependencies.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:8
Finding

Mutable and Unpinned Installation Dependencies Create a Supply-Chain Risk

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill encourages ETH purchases and IPFS uploads but does not prominently warn that blockchain transactions are irreversible, spend real funds, and may incur gas/platform fees, nor that IPFS-pinned content may become effectively public and persistent. In a marketplace skill intended for autonomous agents, omission of these warnings materially raises the risk of financial loss and accidental disclosure of sensitive data.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The README instructs users to run npx clawhub@latest install knowbster, which fetches and executes the latest remote package code at install time rather than a vetted, pinned version. If the upstream package is compromised or a malicious update is published, users or agents could execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The command npx skills add knowbster also relies on executing an unpinned package from the registry, creating supply-chain risk through namespace takeover, dependency compromise, or malicious future releases. In an agent ecosystem, this is especially risky because automated setup may run such commands non-interactively and at scale.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The Quick Start shows initializing the client directly with process.env.PRIVATE_KEY and immediately purchasing knowledge, but it does not warn that this credential controls blockchain funds or that the purchase may spend real ETH on Base L2 mainnet. In the context of a crypto-enabled skill for autonomous agents, this omission materially increases the chance of unsafe key handling, accidental live transactions, or users testing with funded wallets.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill demonstrates access to sensitive environment-backed capabilities such as PRIVATE_KEY and PINATA_JWT, but the manifest does not declare any explicit tool scope or permission boundaries. In an agent ecosystem, this weakens auditability and can allow the skill to be invoked without clear user understanding that wallet credentials and external network actions are involved.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The description uses broad trigger phrases like knowledge acquisition and specialized information, which could cause the skill to activate for many ordinary requests unrelated to cryptocurrency trading. Because this skill can lead to purchases and external data retrieval, overbroad invocation increases the chance of unintended wallet use or exposure to untrusted content.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The skill sends user-supplied knowledge content and metadata to an external third-party service (Pinata/IPFS), which is an actual external transmission of potentially sensitive or proprietary information. In this skill's context, the danger is heightened because the content is intended for decentralized storage, making disclosure broader and more durable than a normal API call.

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

javascript
const uploadToIPFS = async (content) => {
  const response = await fetch('https://api.pinata.cloud/pinning/pinJSONToIPFS', {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${process.env.PINATA_JWT}`,

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The skill sends user-supplied knowledge content and metadata to an external third-party service (Pinata/IPFS), which is an actual external transmission of potentially sensitive or proprietary information. In this skill's context, the danger is heightened because the content is intended for decentralized storage, making disclosure broader and more durable than a normal API call.

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

javascript
const uploadToIPFS = async (content) => {
  const response = await fetch('https://api.pinata.cloud/pinning/pinJSONToIPFS', {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${process.env.PINATA_JWT}`,

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The listing example passes the language value "en" directly, which imposes an English locale in the natural-language metadata flow. The document does not present this as optional user input or justify English as a required locale for a region-specific purpose.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
92% confidence
Finding

The dependency on ethers uses a caret range (^6.9.0), which allows automatic installation of newer minor and patch releases rather than a single audited version. In a crypto-enabled agent skill, dependency drift can introduce breaking behavior or supply-chain risk if a later release contains a vulnerability or malicious compromise.

Content

Scanner excerpt · package.json (reported line 26)May include surrounding context.

json
},
  "homepage": "https://knowbster.com",
  "dependencies": {
    "ethers": "^6.9.0",
    "axios": "^1.6.0"
  }
}

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
97% confidence
Finding

The dependency on axios is not pinned and uses a caret range (^1.6.0), so builds may resolve to different releases over time. Because axios has a history of security advisories, leaving the version floating increases the chance of unexpectedly pulling a vulnerable or otherwise risky version into a network-facing skill.

Content

Scanner excerpt · package.json (reported line 27)May include surrounding context.

json
"homepage": "https://knowbster.com",
  "dependencies": {
    "ethers": "^6.9.0",
    "axios": "^1.6.0"
  }
}

Unverifiable Dependency: axios has 16 known advisory(ies) (CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The manifest references axios without pinning an exact release, while the package has multiple known advisories affecting some versions. In a skill that interacts with external APIs and cryptocurrency-related services, an affected axios version could increase exposure to issues like SSRF, request manipulation, credential leakage, or man-in-the-middle style abuse depending on how the library is used elsewhere in the codebase.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
index.js:70