ClawHub
Back to skill

Security audit

chain-audit-deploy-skill

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its blockchain audit and deployment purpose, but its install and deployment paths can expose wallet keys, run unverified remote code, or send live transactions without strong safeguards.

Review this skill carefully before installing. Use it only in a sandboxed workspace without production wallet files or broad secrets, avoid copy-pasting pipe-to-shell installers, pin and verify blockchain tooling, and do not use mainnet or real private keys unless you have independently checked the exact command and deployment target.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (6)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:199
Finding

Remote Installation Scripts Are Downloaded and Executed Without Integrity Verification

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/deploy_helper.py:97
Finding

Solidity Private Key Is Exposed Through Process Arguments and Failure Reports

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/deploy_helper.py:456
Finding

Mainnet Deployment Confirmation Is Not Enforced

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/deploy_helper.py:195
Finding

Sui Deployment Ignores the Requested Network and RPC Endpoint

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/audit_solana.py:89
Finding

Audit Workflow Executes Build Logic From Potentially Untrusted Projects on the Host

Content
View full analysis
subprocess.CompletedProcess: return subprocess.run( cmd, cwd=cwd, capture_output=True, text=True, timeout=timeout, ) ``` ### Technical Analysis The audit scripts accept an arbitrary project path and invoke its native build system directly on the host. Build tools may resolve external dependencies, execute compiler plugins, run Rust build scripts, process project-controlled configuration, or invoke related tooling. The subprocesses inherit the Skill process's user privileges, environment variables, filesystem access, wallet configuration access, and network access. No container, sandbox, restricted user, sanitized environment, read-only mount, or network policy is applied. An audit of potentially hostile source code should not assume that compiling the project is safe. Static source inspection does not require unrestricted execution of project-controlled build behavior. ### Attack Path 1. An attacker supplies or recommends a crafted smart-contract repository for auditing. 2. The agent follows the Skill's mandatory automated audit workflow. 3. The relevant audit scr ...[truncated 1032 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
examples/sui_move/Move.toml:6
Finding

Tooling and Example Dependencies Use Unpinned or Mutable Sources

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
Findings (32)

External Script Fetching

High
Category
Supply Chain
Confidence
95% confidence
Finding

The README instructs users to run a remote script via 'curl ... | bash', which executes network-fetched code without prior verification. If the source, transport, DNS, or hosting is compromised, a user installing dependencies for this skill could execute arbitrary commands on their machine.

Content

Scanner excerpt · README.md (reported line 40)May include surrounding context.

md
| 链 | 必需工具 | 安装方式 |
|---|---|---|
| Solidity | `forge` (Foundry) | `curl -L https://foundry.paradigm.xyz \| bash && foundryup` |
| Sui Move | `sui` CLI | `cargo install --locked --git https://github.com/MystenLabs/sui.git sui` |
| Solana | `anchor` + `solana` CLI | `cargo install --git https://github.com/coral-xyz/anchor avm && avm install latest` |

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The description overstates the implemented functionality. The code clearly supports Solana program auditing only: it detects Anchor/native Solana layouts, invokes anchor build or Solana cargo build tools, runs cargo audit, and applies Solana/Rust-specific heuristics. There is no logic for Solidity, Sui Move, or Solana deployment workflows (no wallet/network/publish commands, no RPC submission, no key handling, no testnet/mainnet/devnet deployment steps). The auditing portion does align with part of the description for Solana security review, but the declared purpose materially includes undeclared-by-code capabilities—especially deployment and support for other chains/languages—so this is a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The code’s primary behavior is consistent with part of the description: auditing Solidity smart contracts for security issues. However, the declared purpose materially overstates capabilities by claiming deployment support and support for Sui Move and Solana. This script contains no logic for publishing contracts to any network, no wallet/key/network interaction, and no handling of Move or Solana codebases. The mismatch is substantive because those are core declared use cases, not incidental details.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
98% confidence
Finding

The skill tells the agent/user to execute a remote install pipeline using 'curl ... | bash', which is a classic supply-chain risk pattern. If the remote host, network path, or delivered script is compromised, arbitrary code will run immediately in the local environment with the user's privileges, which is especially dangerous in a skill that also handles deployment tooling and potentially sensitive wallet contexts.

Content

Scanner excerpt · SKILL.md (reported line 199)May include surrounding context.

bash
# 1. Prerequisites: Install Foundry
curl -L https://foundry.paradigm.xyz | bash && foundryup

# 2. Build the contract
cd {baseDir}/examples/solidity

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
96% confidence
Finding

This instruction executes shell code fetched at runtime from a remote URL via command substitution, which allows arbitrary code execution if the fetched content is malicious or tampered with. In the context of blockchain deployment tooling, this is particularly risky because the environment may contain wallet files, RPC credentials, and other sensitive assets that could be exfiltrated or abused.

Content

Scanner excerpt · SKILL.md (reported line 341)May include surrounding context.

md
# 1. Prerequisites: Install Anchor and Solana CLI
cargo install --git https://github.com/coral-xyz/anchor avm
avm install latest && avm use latest
sh -c "$(curl -sSfL https://release.anza.xyz/stable/install)"

# 2. Set up wallet and switch to devnet
solana-keygen new                 # if you don't have a keypair

External Script Fetching

High
Category
Supply Chain
Confidence
97% confidence
Finding

The command curl -L https://foundry.paradigm.xyz | bash downloads remote content and immediately executes it in a shell without verification, exposing users to supply-chain compromise, MITM-style installer abuse, or malicious changes on the hosting side. In a developer security/deployment workflow, this is especially dangerous because users are likely to run it on machines holding source code, credentials, or deployment keys.

Content

Scanner excerpt · examples/solidity/README.md (reported line 26)May include surrounding context.

bash
# Install Foundry (if not installed)
curl -L https://foundry.paradigm.xyz | bash && foundryup

# Build
forge build

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · references/solana_audit_rules.md (reported line 35)May include surrounding context.

md
- **Fix**: Hardcode expected program IDs. In Anchor, use `Program<'info, T>` type. In native, assert `program_id == expected_id`.

### 5. Account Data Reinitialization
- **Description**: Writing initial data to an account without checking if it's already initialized, allowing an attacker to reset state.
- **Detection**: Check `init` / `init_if_needed` in Anchor. For native, check if there's an `is_initialized` flag checked before writing.
- **Fix**: In Anchor, prefer `init` over `init_if_needed`. In native, always check and set an `is_initialized` flag.

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
80% confidence
Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · scripts/audit_solana.py (reported line 321)May include surrounding context.

python
if "mut" in line and "constraint" not in line and "has_one" not in line and "seeds" not in line:
                findings.append({
                    "severity": "medium",
                    "title": "Mutable account without constraint",
                    "location": f"{rel_path}:{i}",
                    "description": "Account is marked as mutable but has no constraint or has_one validation.",
                    "recommendation": "Add appropriate constraints (has_one, constraint, seeds) to validate account relationships.",

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/audit_solidity.py (reported line 60)May include surrounding context.

python
def check_tools_only() -> dict:
    """Return availability info for all required tools."""
    tools = {
        "forge": {"install_hint": "curl -L https://foundry.paradigm.xyz | bash && foundryup"},
        "slither": {"install_hint": "pip install slither-analyzer"},
        "solhint": {"install_hint": "npm install -g solhint"},
    }

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/audit_solidity.py (reported line 83)May include surrounding context.

python
def check_tools_only() -> dict:
    """Return availability info for all required tools."""
    tools = {
        "forge": {"install_hint": "curl -L https://foundry.paradigm.xyz | bash && foundryup"},
        "slither": {"install_hint": "pip install slither-analyzer"},
        "solhint": {"install_hint": "npm install -g solhint"},
    }

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/deploy_helper.py (reported line 144)May include surrounding context.

python
def check_tools_only() -> dict:
    """Return availability info for all required tools."""
    tools = {
        "forge": {"install_hint": "curl -L https://foundry.paradigm.xyz | bash && foundryup"},
        "slither": {"install_hint": "pip install slither-analyzer"},
        "solhint": {"install_hint": "npm install -g solhint"},
    }

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The Solidity deploy path reads the private key from an environment variable and appends the secret value directly to the forge command line. Command-line arguments are often exposed via process listings, logs, crash reports, and this script also returns the full command string on failures and dry runs, creating a real secret disclosure risk for blockchain deployment keys.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
60% confidence
Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/deploy_helper.py (reported line 234)May include surrounding context.

python
# Execute
    try:
        # Set env to json output
        env = os.environ.copy()
        r = _run(cmd + ["--json"], cwd=args.path, timeout=300)
        output = (r.stdout or "") + "\n" + (r.stderr or "")

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill description is presented entirely in Chinese and does not indicate that users may choose another language or locale. Under the language/locale policy, forcing a specific language without opt-in is a natural-language policy concern unless the regional constraint is documented and justified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The README says users can 'directly use natural language' and lists triggers such as '审计我的合约', '部署到测试网', and '有哪些例子' without any stated invocation boundary, command prefix, or exclusion conditions. These phrases are broad enough that normal discussion about contracts or examples could unintentionally activate the skill.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill clearly instructs the agent to read files, inspect environment-based credentials, and execute shell commands, but it declares no explicit tool scope or allowed-tools boundary. That creates an over-privileged, under-specified execution model where an agent may use powerful capabilities without policy-level restriction, increasing the chance of unintended command execution, secret exposure, or filesystem access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The guide provides live EVM deployment commands using --private-key $PRIVATE_KEY and --broadcast/verification flows without an explicit warning that these actions can spend real funds, publish irreversible on-chain state, or expose sensitive key material through shell history, process inspection, or poor operator practices. In a deployment-focused skill, users are likely to copy-paste commands directly, which increases the chance of accidental mainnet deployment or insecure key handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The Sui publish and upgrade examples perform real on-chain state changes and consume gas, yet the guide does not explicitly warn operators that these commands affect the active environment and wallet. Because the document is an operational deployment guide, omission of this warning can lead to unintended publication or upgrades on mainnet/testnet with financial or governance consequences.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The Solana deployment section references ~/.config/solana/id.json and live solana program deploy commands without warning that the local keypair controls funds and deployment authority, or that choosing the wrong cluster can cause unintended production deployment. Users following the guide may expose sensitive wallet files or deploy to the wrong network, leading to financial loss or operational mistakes.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/solana_audit_rules.md (reported line 35)May include surrounding context.

md
- **Fix**: Hardcode expected program IDs. In Anchor, use `Program<'info, T>` type. In native, assert `program_id == expected_id`.

### 5. Account Data Reinitialization
- **Description**: Writing initial data to an account without checking if it's already initialized, allowing an attacker to reset state.
- **Detection**: Check `init` / `init_if_needed` in Anchor. For native, check if there's an `is_initialized` flag checked before writing.
- **Fix**: In Anchor, prefer `init` over `init_if_needed`. In native, always check and set an `is_initialized` flag.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/solidity_audit_rules.md (reported line 42)May include surrounding context.

md
- **Fix**: Hardcode expected program IDs. In Anchor, use `Program<'info, T>` type. In native, assert `program_id == expected_id`.

### 5. Account Data Reinitialization
- **Description**: Writing initial data to an account without checking if it's already initialized, allowing an attacker to reset state.
- **Detection**: Check `init` / `init_if_needed` in Anchor. For native, check if there's an `is_initialized` flag checked before writing.
- **Fix**: In Anchor, prefer `init` over `init_if_needed`. In native, always check and set an `is_initialized` flag.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/solidity_audit_rules.md (reported line 100)May include surrounding context.

md
- **Fix**: Hardcode expected program IDs. In Anchor, use `Program<'info, T>` type. In native, assert `program_id == expected_id`.

### 5. Account Data Reinitialization
- **Description**: Writing initial data to an account without checking if it's already initialized, allowing an attacker to reset state.
- **Detection**: Check `init` / `init_if_needed` in Anchor. For native, check if there's an `is_initialized` flag checked before writing.
- **Fix**: In Anchor, prefer `init` over `init_if_needed`. In native, always check and set an `is_initialized` flag.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The script automatically runs project-local build tooling (for example anchor build / cargo build helpers) against an untrusted target repository. In Rust and Solana ecosystems, build steps can execute attacker-controlled code through build.rs scripts, proc macros, toolchain hooks, or dependency resolution side effects, so auditing a hostile project can become local code execution on the analyst machine.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Running cargo audit in the target project directory still invokes Cargo on attacker-supplied project metadata and lockfiles without any confirmation or isolation. Even though cargo audit is less dangerous than a full build, Cargo-based operations against untrusted repos can still trigger unsafe local interactions or dependency-related execution paths, making this risky in an agent skill intended to inspect arbitrary user projects.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/audit_solidity.py (reported line 35)May include surrounding context.

python
def _run(cmd: list[str], cwd: str, timeout: int = 300) -> subprocess.CompletedProcess:
    """Run *cmd* and return the CompletedProcess."""
    return subprocess.run(
        cmd,
        cwd=cwd,
        capture_output=True,