ClawHub
Back to skill

Security audit

DEX Arbitrage DEX套利

Security checks for vulnerabilities and agentic risk

Overview

This paid DEX arbitrage skill matches its advertised purpose, but it ships unsafe billing code and deployable trading templates that could expose users to billing and on-chain fund-loss risk.

Review carefully before installing. The skill is not judged malicious, but users should avoid running its billing code or deploying generated flash-loan contracts as-is; the billing credential should be rotated and loaded from the declared environment variable, and the contract templates need initiator checks, balance-delta accounting, nonzero slippage limits, safer signing guidance, and testnet/fork validation before any mainnet use.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
payment.py:11
Finding

Hardcoded Billing API Credential Exposed in Distributed Source Code

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/flashloan_generator.py:116
Finding

Externally Initiated Flash Loan Can Divert Contract Funds to an Attacker-Controlled Recipient

Content
View full analysis
= amountOwed + MIN_PROFIT, "Insufficient profit"); // 授权还款 IERC20(asset).approve(address(POOL), amountOwed); // 发送利润给执行者 uint256 profit = finalBalance - amountOwed; IERC20(asset).transfer(executor, profit); emit ArbitrageExecuted(asset, amount, profit, executor); } catch Error(string memory reason) { emit ArbitrageFailed(asset, amount, reason); revert(reason); } catch { emit ArbitrageFailed(asset, amount, "Unknown error"); revert("Arbitrage execution failed"); } return true; } ``` ### Technical Analysis The generated contract verifies that the callback caller is the Aave Pool, but it does not verify the `initiator` parameter. Aave flash-loan callbacks can be caused by an external account requesting a loan with this contract as the receiver. Consequently, checking only `msg.sender == address(POOL)` does not prove that the owner-authorized `executeArbitrage` function initiated the operation. The callback also decodes `executor` from at ...[truncated 2149 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/flashloan_generator.py:180
Finding

Generated Flash-Loan Contracts Disable Slippage Protection

Content
View full analysis
Remediation
View remediation
0, "Minimum output required"); ``` 4. Calculate minimum output from a recent trusted quote with a bounded slippage tolerance. 5. Validate execution prices against a manipulation-resistant oracle or TWAP where appropriate. 6. Accept and enforce a caller-specified deadline rather than always using `block.timestamp`. 7. Add pool-liquidity, token, fee-tier, and route allowlists. 8. Simulate the complete transaction immediately before submission. 9. Submit valuable arbitrage transactions through a reputable private relay to reduce public-mempool exposure. 10. Test the generated contracts against sandwich attacks, reserve manipulation, stale quotes, and sudden liquidity withdrawal. ]]>

T09 · Insecure Skill Coding Practices

Warning
Location
references/flashloan-arbitrage.md:233
Finding

Flash-Loan Reference Template Demonstrates an Unsafe Zero-Minimum Swap

Content
View full analysis
Remediation
View remediation
0, "Invalid expected output"); require(slippageBps <= MAX_SLIPPAGE_BPS, "Excessive slippage"); uint256 minAmountOut = expectedAmountOut * (10_000 - slippageBps) / 10_000; ``` 4. Explain the trust assumptions and freshness requirements of the quote used to derive `expectedAmountOut`. 5. Add oracle or TWAP validation for high-value execution. 6. Clearly label incomplete examples as non-deployable, but still avoid insecure placeholder values in executable code. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (42)

Tainted flow: 'user_id' from os.environ.get (line 96, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · payment.py (reported line 29)May include surrounding context.

python
def check_balance(user_id: str) -> float:
    """查询用户余额"""
    try:
        resp = requests.get(
            f"{BILLING_API_URL}/api/v1/billing/balance",
            params={"user_id": user_id},
            headers=HEADERS,

Tainted flow: 'user_id' from os.environ.get (line 96, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
96% confidence
Finding

The code automatically transmits an environment-derived user identifier to an external billing service and attempts to charge the user on skill start. In this skill context, that behavior is unrelated to DEX arbitrage functionality and enables unauthorized or unexpected billing actions tied to ambient environment state without explicit user confirmation.

Content

Scanner excerpt · payment.py (reported line 48)May include surrounding context.

python
返回: {"ok": bool, "balance": float, "payment_url": str|None}
    """
    try:
        resp = requests.post(
            f"{BILLING_API_URL}/api/v1/billing/charge",
            headers=HEADERS,
            json={

Tainted flow: 'user_id' from os.environ.get (line 96, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · payment.py (reported line 79)May include surrounding context.

python
def get_payment_link(user_id: str, amount: float = 5.0) -> str:
    """生成充值链接"""
    try:
        resp = requests.post(
            f"{BILLING_API_URL}/api/v1/billing/payment-link",
            headers=HEADERS,
            json={"user_id": user_id, "amount": amount},

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

If the skill generates deployable Solidity flash-loan or arbitrage contracts and deployment scripts without clearly declaring that code-generation/deployment capability, it materially changes the risk profile of the skill. In this context, undeclared generation of executable on-chain code is dangerous because users may trust it as advisory content while it actually produces high-risk financial automation that could cause fund loss, unsafe deployments, or facilitate abuse.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding

If the skill generates deployable Solidity flash-loan or arbitrage contracts and deployment scripts without clearly declaring that code-generation/deployment capability, it materially changes the risk profile of the skill. In this context, undeclared generation of executable on-chain code is dangerous because users may trust it as advisory content while it actually produces high-risk financial automation that could cause fund loss, unsafe deployments, or facilitate abuse.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

If the skill generates deployable Solidity flash-loan or arbitrage contracts and deployment scripts without clearly declaring that code-generation/deployment capability, it materially changes the risk profile of the skill. In this context, undeclared generation of executable on-chain code is dangerous because users may trust it as advisory content while it actually produces high-risk financial automation that could cause fund loss, unsafe deployments, or facilitate abuse.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

If the skill generates deployable Solidity flash-loan or arbitrage contracts and deployment scripts without clearly declaring that code-generation/deployment capability, it materially changes the risk profile of the skill. In this context, undeclared generation of executable on-chain code is dangerous because users may trust it as advisory content while it actually produces high-risk financial automation that could cause fund loss, unsafe deployments, or facilitate abuse.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The file implements a full billing/paywall mechanism even though the declared skill is a DEX arbitrage assistant. This mismatch is dangerous because hidden monetization logic can exfiltrate user identifiers, interrupt execution, and impose charges unrelated to the advertised capability, which is a strong indicator of deceptive or unauthorized behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
76% confidence
Finding

The skill advertises capabilities that imply network access, environment use, and file-writing related artifacts, but it does not declare any explicit tool scope or permissions boundaries. In an agent setting, missing scope declarations can cause the runtime or reviewers to underestimate what the skill may access, increasing the risk of unintended network calls, file modification, or secret exposure through auxiliary scripts or referenced components.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The metadata declares that use of this DEX arbitrage skill requires access to payment-provider credentials via environment variables, even though those secrets are unrelated to the core arbitrage analysis function described. This creates an unnecessary secret exposure path: any skill invocation or downstream code tied to the skill could gain access to billing credentials, increasing the blast radius if the skill is compromised or overly permissive.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

This request sends user billing data to an external domain and performs a charge attempt. Because it is embedded in a skill whose stated purpose is DEX arbitrage rather than payments, the transmission is contextually suspicious and creates real risk of unauthorized charging and privacy leakage.

Content

Scanner excerpt · payment.py (reported line 48)May include surrounding context.

python
返回: {"ok": bool, "balance": float, "payment_url": str|None}
    """
    try:
        resp = requests.post(
            f"{BILLING_API_URL}/api/v1/billing/charge",
            headers=HEADERS,
            json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This request transmits user-linked data to an external payment service to obtain a payment URL. External transmission of identity-linked billing data is sensitive, and in this skill context it is not justified by the advertised arbitrage function, making it a meaningful privacy and trust concern.

Content

Scanner excerpt · payment.py (reported line 79)May include surrounding context.

python
def get_payment_link(user_id: str, amount: float = 5.0) -> str:
    """生成充值链接"""
    try:
        resp = requests.post(
            f"{BILLING_API_URL}/api/v1/billing/payment-link",
            headers=HEADERS,
            json={"user_id": user_id, "amount": amount},

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The code reads SKILLPAY_USER_ID from the environment to identify and bill a user, despite that capability not being necessary for DEX arbitrage analysis. Using ambient environment identity for billing increases the risk of misbilling, privacy violations, and cross-context abuse if the environment variable is set unexpectedly or shared across executions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The function is documented as a payment verification step, but it actually attempts to charge the user by calling charge_user(). That discrepancy is dangerous because reviewers and users may believe the function is a harmless status check when it performs a state-changing financial action, increasing the chance of surprise charges and hidden behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill attempts to deduct payment automatically at startup and transmits user data to an external billing provider without prior warning or explicit confirmation. In the context of an arbitrage helper, this is especially risky because users would not reasonably expect hidden financial side effects before receiving core functionality.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This section describes manual, semi-automatic, and fully automated arbitrage execution involving real trades, cross-chain transfers, and flash-loan-style strategies, but it does not provide a clear warning that users can lose real funds due to slippage, failed transactions, MEV, bridge delays, contract risk, or volatile gas costs before attempting execution. In a trading-assistant skill, omission of an explicit financial-risk warning can cause users to treat procedural guidance as safe-to-run operational advice, increasing the chance of preventable monetary loss.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/arbitrage-tools.md (reported line 58)May include surrounding context.

代码示例:

javascript
const response = await fetch(
    `https://api.1inch.dev/swap/v5.2/1/quote?` +
    `src=${USDC}&dst=${ETH}&amount=1000000000`,
    {
        headers: { 'Authorization': 'Bearer YOUR_API_KEY' }

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This section includes transaction signing and on-chain execution examples using a wallet/private key, but provides no safety warning about irreversible financial actions, key custody, slippage, approval scope, or testing on a fork/testnet first. In an arbitrage skill, users are especially likely to copy-paste and run code quickly, which increases the chance of accidental fund loss or unsafe key handling.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/arbitrage-tools.md (reported line 144)May include surrounding context.

使用:

javascript
const response = await fetch(
    `https://api.0x.org/swap/v1/quote?` +
    `buyToken=ETH&sellToken=USDC&sellAmount=1000000000`
);
const quote = await response.json();

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/arbitrage-tools.md (reported line 163)May include surrounding context.

API:

javascript
const route = await fetch('https://li.quest/v1/quote', {
    method: 'POST',
    body: JSON.stringify({
        fromChain: 'ETH',

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The Foundry deployment example passes a private key directly via CLI (--private-key $PK) without any warning about shell history, process exposure, environment leakage, or the risk of deploying real-value contracts to mainnet. In a DeFi/arbitrage context this is more dangerous because users may operate funded wallets and production RPCs, so weak operational security can lead directly to wallet compromise or costly mistakes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This guide gives concrete cross-chain arbitrage workflows, bridge selection advice, and automation examples that could prompt users to perform real fund transfers, but it does not prominently warn that bridge operations are irreversible, time-delayed, and exposed to slippage, bridge compromise, chain congestion, and execution failure. In the context of a DEX arbitrage skill, this is more dangerous because users are likely to treat the instructions as actionable trading guidance and may incur direct financial losses if they follow them without strong risk disclosures.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The comment says 不还利息模式 ('no-interest mode'), but the surrounding flash-loan implementation still calculates and repays premiums[0]. In a financial smart-contract guide, this mismatch can mislead users into misunderstanding protocol behavior, cost assumptions, and profitability calculations, increasing the chance of deploying loss-making or broken arbitrage logic.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This section gives actionable instructions to execute a high-value flash-loan arbitrage transaction, including gas settings and a $1,000,000-sized example, without an immediate warning that users can incur real financial loss from slippage, failed execution, MEV competition, bad parameters, or contract bugs. In the context of a DEX arbitrage skill, the omission is more dangerous because the content is explicitly operational and may encourage inexperienced users to run risky mainnet transactions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

该 markdown 文件全文以中文呈现，未见任何提示说明这是特定地区/受众限定内容，也未提供用户可选择其他语言的说明。按照语言/locale 政策，强制单一语言而无用户选择或明确正当性，属于自然语言层面的政策问题。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.