T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:21- Finding
Untrusted Remote Instructions Are Retrieved and Applied at Runtime
- Content
View full analysis
- Remediation
View remediation
Security audit
Shekel Hyperliquid Trading
Security checks for vulnerabilities and agentic risk
Overview
This trading skill is purpose-aligned overall, but it asks agents to accept remote replacement instructions and persist a powerful financial API key in memory.
Review this carefully before installing. The skill may trade futures, manage funds, withdraw assets, export wallet key material, and alter account state using a single API key. Do not store that key in agent memory; use a dedicated secret manager if available, rotate any key already written to memory or logs, and require fresh confirmation for withdrawals, wallet export, account deletion, vault operations, schedule changes, and any run that bypasses the whitelist. The remote-instruction update behavior is the largest review issue because the service can change what the agent is told to do after installation.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:303- Finding
Financial API Credential Is Persisted and Re-read from Agent Memory
- Content
View full analysis
- registeredAt: - depositAddress: <0x...> (Arbitrum/Base) ``` > This allows you to recall the API key in future sessions without asking the user again. OpenClaw memory is encrypted at rest — it is safe to store the key here. **3. Verify you can recall it** After writing to memory, immediately read it back and confirm the key matches what the server returned. This proves the memory write succeeded before you move on. ``` Related behavior is also specified at line 124: ```markdown **Check your memory first.** If you saved credentials during onboarding (see Step 2a), load them from `MEMORY.md` — do not ask the user for their API key if you already have it. Only ask if memory is empty or the key returns a `401`. ``` ### Technical Analysis The Skill explicitly writes a bearer credential into a Markdown memory file and then reads it back. The API key authorizes sensitive account and financial operations, including autonomous trading, account configuration, withdrawals, key export, vault management, and account deletion. The assertion that memory is encrypted at rest is not established by the audited artifact and may not hold across every compatible runtime, backup mechanism, synchronization service, debugging interface, memory retrieval system, or deployment configuration. Encryption at rest would also not prevent disclosure to other agents, tools, prompts, plugins, administrators, logs, or processes that can read the decrypted memory. St ...[truncated 1992 chars]- Remediation
View remediation
T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:499- Finding
Single-Ticker Execution Bypasses the Whitelist and Accepts Arbitrary LLM Context Overrides
- Content
View full analysis
" \ -H "Content-Type: application/json" \ -d '{ "ticker": "BTC" }' ``` **Optional body fields for single-ticker runs** (all auto-fetched if omitted): | Field | Type | Description | |---|---|---| | `ticker` | string | Run on this ticker only, bypassing the whitelist | | `tokenData` | any | Override server-fetched token data | | `sentiment` | any | Override server-fetched sentiment | | `marketData` | any | Additional market context | | `customData` | any | Any extra data to inject into the LLM prompt | | `skillGuidance` | any | External signals for the LLM | | `tradingMemoryContext` | any | Override the agent's trading memory | ``` ### Technical Analysis The execution endpoint intentionally allows a caller to bypass the configured trading whitelist. It also accepts multiple fields of unrestricted type `any`, including direct LLM prompt input, external guidance, and an override for trading memory. The whitelist is a material financial safety boundary because it limits which markets an autonomous agent can trade. Permitting an individual request to bypass that boundary undermines the user’s persistent configuration. The unrestricted context fields create a prompt-injection and data-integrity risk. A caller or upstream integration can replace trusted market information and trading memory with fabricated data or imperative instructions. Because `/agent/run` executes recommendations automatically, manipulated context may affect real financial orders rather than merely producing untrusted text. The flagged `tokenData` field is an inbound override sen ...[truncated 2187 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (13)
Ssd 3
Critical
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The onboarding checklist mandates saving the API key to the agent's own memory and confirming that it can be recalled. This is especially dangerous because the secret appears to provide broad control over deposits, withdrawals, trading, key rotation, export of wallet key material, and account deletion, so compromise of stored memory can directly lead to account takeover and financial loss.
- Content
Ssd 3
Critical
- Category
- Not specified by scanner
- Confidence
- 100% confidence
- Finding
The skill includes verbatim instructions to say the API key aloud to the user, save it into memory, and verify recall. This creates multiple disclosure paths for a high-value secret: conversational output, persistent storage, and subsequent retrieval, all of which increase the chance of secret leakage and unauthorized trading/account actions.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 80% confidence
- Finding
The skill exposes highly destructive capabilities such as account deletion and wallet-key export in the same interface used for routine trading operations, with no documented requirement for secondary confirmation, step-up authentication, or strong guardrails. In an agentic setting, this increases the risk that prompt injection, misunderstanding, or misuse of tool parameters could trigger irreversible account compromise or destruction.
- Content
md | Withdraw to Arbitrum | `POST /account/withdraw` | | Rotate API key | `POST /auth/rotate-key` | | Export trading wallet key | `POST /auth/export-agent-key` | | Delete account | `DELETE /auth/account` | | Available models | `GET /agents/models` — returns `{ venice: [...], rei: [...] }` | | Available markets | `GET /markets/tickers` | | **Create vault (agent as fund manager)** | `POST /vault/create` |
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill directs the agent to retain and recall the user's API key across sessions instead of asking again. Storing reusable secrets in persistent memory creates a long-lived target that can be exfiltrated by prompt injection, memory inspection, or accidental model disclosure, especially because the same key appears to authorize all account actions.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The skill explicitly instructs the agent to persist a live trading API key in memory for future reuse and to verify recall. Persisting reusable credentials in agent memory materially increases the blast radius of prompt injection, memory leakage, unauthorized reuse across sessions, and accidental disclosure through logs or future conversations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The dashboard instructions direct users to paste their API key into a web UI that uses the same bearer token for full account control, but they do not prominently warn that this credential is highly sensitive and grants trading and account-management authority. Users may be conditioned to enter powerful secrets into third-party interfaces without understanding the trust implications.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 88% confidence
- Finding
The directive to consult memory first and not ask the user for their API key encourages autonomous reuse of a highly sensitive credential. In this context, the autonomy is risky because the key unlocks consequential financial operations and the user may be unaware the agent is still able to act on their behalf.
- Content
md > This is the common case — check here first. **Check your memory first.** If you saved credentials during onboarding (see Step 2a), load them from `MEMORY.md` — do not ask the user for their API key if you already have it. Only ask if memory is empty or the key returns a `401`. If you must ask the user, only ask for their `apiKey` — that is the only credential needed for everything.
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The documentation tells the agent to check memory first and avoid asking the user again for the API key, encouraging persistent retention of a sensitive credential without a clear warning about cross-session secret handling risks. This normalizes silent credential reuse and reduces user awareness and control over how their trading credential is stored and accessed.
- Content
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Confidence
- 86% confidence
- Finding
The instruction to recall the API key in future sessions 'without asking the user again' reduces user awareness and consent for reuse of a powerful credential. In a financial-trading context, silent reuse of stored credentials makes prompt-injection or unintended autonomous actions more dangerous because the agent can act with full account authority without re-authentication.
- Content
- depositAddress: <0x...> (Arbitrum/Base)
text > This allows you to recall the API key in future sessions without asking the user again. OpenClaw memory is encrypted at rest — it is safe to store the key here. **3. Verify you can recall it**
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Once they choose, enable the built-in schedule via
PUT /agents/:id:bash curl -X PUT https://shekel-skill-backend.onrender.com/agents/<agentId> \ -H "Authorization: Bearer <apiKey>" \ -H "Content-Type: application/json" \ -d '{"runScheduleMinutes": 240}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Example — disable Athena and sentiment:
bash curl -X PUT https://shekel-skill-backend.onrender.com/agents/<agentId> \ -H "Authorization: Bearer <apiKey>" \ -H "Content-Type: application/json" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Set or change at any time via
PUT /agents/:id:bash curl -X PUT .../agents/<agentId> \ -H "Authorization: Bearer <apiKey>" \ -H "Content-Type: application/json" \ -d '{ "marginMode": "isolated" }'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Option A: Create a vault (automatic linkage) curl -X POST .../vault/create \ -H "Authorization: Bearer <apiKey>" \ -d '{"name":"My AI Fund","description":"BTC/ETH momentum strategy","initialUsd":200}' # Returns the vault address and automatically links the agent
Static analysis
No suspicious patterns detected.