ClawHub
Back to skill

Security audit

local-portfolio-auditor

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent read-only portfolio checker, but users should understand it sends portfolio lookup data to public APIs and has a dependency/API-key logging hygiene issue.

Install only if you are comfortable with the skill reading a local portfolio.json file and sending coin IDs, Ethereum wallet addresses, and an optional Etherscan API key to third-party public APIs. Use a limited Etherscan key, avoid sharing logs from failed runs, and update the requests dependency before production use.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
main.py:53
Finding

Etherscan API Key Exposure Through Exception Logging

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 17)May include surrounding context.

md
## Installation

1.  **Create Skill Directory:** Create a new folder named `local-portfolio-auditor` in your ClawBot skills directory (e.g., `~/.openclaw/skills/` or `<project>/skills/`).
2.  **Download Files:** Place the `SKILL.md`, `main.py`, `requirements.txt`, and `portfolio.json` files into this new directory.
3.  **Install Dependencies:** Navigate to the `local-portfolio-auditor` directory in your terminal and install the required Python packages:
    ```bash

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documented trigger phrases are very broad and generic, making accidental or overly permissive activation more likely in normal conversation. In an agent setting, weak activation constraints can cause the skill to run on unintended requests and access local financial configuration data or initiate external API calls without sufficiently explicit user intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger phrases are generic enough to match ordinary user requests about portfolios, crypto holdings, or stock values, which can cause the skill to activate outside a narrowly intended context. In an agent system, overly broad activation can expose local-file-reading behavior more often than expected and increase the chance of unintended data access or confusing tool selection.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · main.py (reported line 9)May include surrounding context.

python
# --- Configuration ---
# API Endpoints (using CoinGecko for crypto, placeholder for stocks)
COINGECKO_API_BASE = "https://api.coingecko.com/api/v3"
# For stocks, a free, reliable API is harder to come by without registration/limits.
# Alpha Vantage is an option, but requires an API key and has rate limits.
# For this example, we'll use a placeholder and emphasize secure API key handling.

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

The code sends the user's Ethereum address and API key to Etherscan over an external network request. While HTTPS protects the transport, the transmission exposes portfolio-identifying information to a third party and can enable financial profiling if users are unaware of this behavior.

Content

Scanner excerpt · main.py (reported line 57)May include surrounding context.

python
return 1.5 # Dummy balance

    try:
        url = f"https://api.etherscan.io/api?module=account&action=balance&address={address}&tag=latest&apikey={etherscan_api_key}"
        response = requests.get(url, timeout=10)
        response.raise_for_status()
        data = response.json()

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill transmits a user's cryptocurrency wallet address to Etherscan to retrieve balances, which is portfolio-related data and can reveal sensitive financial holdings. Although this is functionally required for the feature and uses HTTPS, the main flow does not clearly disclose that user-provided portfolio identifiers will be sent to third-party services, creating a privacy and data-sharing risk.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: requests==2.31.0 — 6 advisory(ies): CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi); CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func) +3 more

Medium
Category
Supply Chain
Confidence
97% confidence
Finding

The file pins requests to version 2.31.0, which is identified by the finding as having multiple published advisories. Shipping a dependency with known security issues is a real supply-chain risk because any code in the skill that performs HTTP requests may inherit flaws such as credential leakage, weakened verification behavior, or unsafe file handling depending on how the library is used.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.