ClawHub
Back to skill

Security audit

Develop Secure Contracts

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent OpenZeppelin smart-contract helper that reads project and dependency code to apply library-based contract changes, with no evidence of hidden persistence, exfiltration, or destructive behavior.

Install this only if you want an agent to inspect and modify smart-contract code using OpenZeppelin patterns. Review every generated contract diff, run the project’s tests and security tooling, and do not deploy or upgrade contracts without an independent audit process.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

MCP Config Access

High
Category
Agent Snooping
Content
### Checking Availability

Discover MCP tools dynamically at runtime. Look for tools with names matching patterns like `solidity-erc20`, `cairo-erc721`, `stellar-fungible`, etc. Server names follow patterns like `OpenZeppelinSolidityContracts`, `OpenZeppelinCairoContracts`, or `OpenZeppelinContracts`.

MCP tool schemas are self-describing. To learn what a generator supports, inspect its parameter list — each boolean parameter (e.g., `pausable`, `mintable`, `upgradeable`) corresponds to a feature toggle. Do not rely on prior knowledge of what parameters exist; read the schema each time, since tools are updated independently of this skill.
Confidence
84% confidence
Finding
The skill instructs the agent to dynamically enumerate MCP tools and inspect their schemas at runtime. In an adversarial or multi-tenant environment, that can expand the agent's knowledge of available capabilities beyond the user's immediate request and enable capability discovery that may be abused to reach higher-risk tools or sensitive configuration metadata.

Session Persistence

Medium
Category
Rogue Agent
Content
1. **Exact match exists?** Import and use it directly — inherit, implement its trait, compose with it. Done.
2. **Close match exists?** Import and extend it — override only functions the library marks as overridable (virtual, hooks, configurable parameters).
3. **No match exists?** Only then write custom logic. Confirm by browsing the library's directory structure first.

**NEVER copy or embed library source code into the user's contract.** Always import from the dependency so the project receives security updates. Never hand-write what the library already provides:
- Never write a custom `paused` modifier when `Pausable` or `ERC20Pausable` exists
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
integrate into existing code.
3. Check for conflicts: duplicate access control systems, conflicting function overrides,
   incompatible inheritance. Resolve before finishing.
4. Do not ask the user to make changes themselves — apply directly.

### Repository and Documentation Lookup Table
Confidence
80% confidence
Finding
The instruction to 'apply directly' and not ask the user to make changes themselves encourages autonomous code modification without a confirmation checkpoint. In a coding agent, this increases the chance of unintended or unsafe edits, especially when integrating security-sensitive smart contract components where inheritance, storage layout, and access control mistakes can introduce exploitable flaws.

Static analysis

No suspicious patterns detected.