Xanadu Crypto Monitor

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:00 AM UTC
• Version: 1.0.0

Overview

The crypto monitoring skill mostly does what it advertises, but it ships a payment-charging module with an exposed billing key and weak user-control boundaries.

Review this skill carefully before installing. The crypto monitoring functions are ordinary, but the included billing files should be removed or fixed before use: rotate the exposed SkillPay key, require explicit user confirmation and server-side authorization for any charge, and document local storage of alerts and portfolio holdings.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/billing_config.py:1

Finding

Hardcoded SkillPay API Credential and Sensitive Billing Data Transmission

Content

View full analysis

Dict: """Charge user for skill usage""" amount = amount or DEFAULT_PRICE try: response = requests.post( f"{self.base_url}/charge", json={ "api_key": self.api_key, "skill_id": self.skill_id, "user_id": user_id, "amount": amount }, timeout=10 ) return response.json() except Exception as e: return {"success": False, "error": str(e)} ``` ### Technical Analysis A secret-looking SkillPay API key is embedded directly in a source file distributed with the Skill. Anyone who can download, inspect, or otherwise access the package can recover the credential without needing additional privileges. The billing client transmits that API key in a JSON request body alongside a user identifier, Skill identifier, and charge amount. HTTPS protects the request in tran ...[truncated 2640 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The charge method directly submits billing requests to an external payment service using caller-supplied user_id and amount, with no authentication, authorization, integrity checks, or user-consent guardrails shown here. In a social media manager context, direct charging is not inherently justified, making unauthorized or abusive billing a significant risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The file contains a hardcoded secret key that appears to be a live API credential. Embedding secrets directly in source code makes them accessible to anyone with repository or package access, enabling unauthorized billing API use, account abuse, fraudulent charges, or service takeover. In a billing configuration file, this is especially dangerous because the credential is directly tied to payment-related operations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This module loads a payment API key and billing identifiers for a social media manager skill without any visible access-control, consent, or purpose limitation in the file. In this context, adding billing capability broadens the attack surface and can enable unauthorized charging or covert monetization if invoked by other parts of the skill.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/billing.py (reported line 26)May include surrounding context.

python

def __init__(self, api_key: str = None, skill_id: str = None):
        self.api_key = api_key or SKILLPAY_API_KEY
        self.skill_id = skill_id or SKILL_ID
        self.base_url = "https://api.skillpay.me/v1"
        
        if not self.api_key:
            raise ValueError("SkillPay API key required")

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 83% confidence

Finding

This is a real external transmission to a remote billing API, carrying user and payment-related data. External transmission is not automatically malicious, but in this skill it is security-relevant because it enables outbound exfiltration of identifiers and execution of payment actions.

Content

Scanner excerpt · scripts/billing.py (reported line 36)May include surrounding context.

python

amount = amount or DEFAULT_PRICE
        
        try:
            response = requests.post(
                f"{self.base_url}/charge",
                json={
                    "api_key": self.api_key,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code transmits sensitive billing fields including API key, user_id, and amount to a third-party endpoint, but this file provides no notice, consent, minimization, or secure handling guarantees beyond basic HTTPS usage. This creates privacy and secret-exposure risk, especially if logs, errors, or downstream systems capture request contents.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 71% confidence

Finding

The script transmits user-requested cryptocurrency symbols and portfolio-related lookup data to the external CoinGecko API without explicit disclosure, timeout control, or any option to disable outbound requests. In a skill or agent environment, this can leak a user's interests or holdings metadata to a third party and may also cause hangs or reliability issues if the remote service is slow or unavailable.

Content

Scanner excerpt · scripts/monitor.py (reported line 23)May include surrounding context.

python

DEFAULT_DATA_DIR.mkdir(parents=True, exist_ok=True)

# CoinGecko API (free tier)
BASE_URL = "https://api.coingecko.com/api/v3"

# Common crypto mapping (symbol -> id)
CRYPTO_MAP = {

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill documentation states that alerts are stored in ~/.openclaw/crypto-monitor/alerts.json and describes portfolio tracking, but it does not clearly warn users up front that financial watchlists and portfolio-related data may be written to local storage. While this is not remote code execution or data exfiltration, it can expose sensitive financial preferences or holdings to other local users, backups, or synced folders if users are unaware of the persistence behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The top-level docstring describes the skill as providing "whale tracking," which implies actual transaction monitoring capability. However, the only whale-related implementation is a CLI branch that prints a notice that a blockchain API would be required and does not perform any tracking logic.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The function writes alert definitions to ~/.openclaw/crypto-monitor/alerts.json, which is a persistent file write. While the script prints confirmation after saving, the command help and surrounding documentation do not warn users that alert settings will be stored on disk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code saves user-supplied portfolio holdings into ~/.openclaw/crypto-monitor/portfolio.json, which is a file write affecting user data. Although it prints a success message afterward, there is no warning before the write and the docstring/CLI help do not disclose that the data will be persisted locally.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.