ClawHub
Back to skill

Security audit

DEX Price Monitor DEX价格监控

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its DEX monitoring purpose, but it includes billing code that can charge a user account and exposes a hard-coded payment API key.

Review before installing. The DEX features are not the main issue; the payment integration is. Install only if you trust the publisher and SkillPay flow, understand that each invocation may charge 0.01 USDT, and are comfortable with your SkillPay user ID being sent to skillpay.me. The embedded API key should be considered compromised and rotated before release.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
payment.py:11
Finding

Hard-Coded Billing API Credential

Content
View full analysis

Vulnerability Details

File Location: payment.py:11-18
Vulnerability Type: Hard-coded API secret
Risk Level: High

Vulnerable Code

python
BILLING_API_URL = "https://skillpay.me"
BILLING_API_KEY = "sk_f03aa8f8bbcf79f7aa11c112d904780f22e62add1464e3c41a79600a451eb1d2"
SKILL_ID = "a2ad3e21-d3b5-4c6c-ad49-57810ceddf0b"
SKILL_NAME = "dex-price-monitor"
PRICE_PER_CALL = 0.01  # USDT

HEADERS = {
    "X-API-Key": BILLING_API_KEY,
    "Content-Type": "application/json"
}

Technical Analysis

A live-format SkillPay API key is embedded directly in distributed source code. Anyone who can download, inspect, or otherwise access the Skill package can recover the credential without defeating any access control.

The credential is assigned to the global HEADERS object and subsequently attached to balance, charge, and payment-link requests made to the billing provider. Its placement also conflicts with _meta.json:11-14, which specifies that the API key should be supplied through the SKILLPAY_API_KEY environment variable:

json
"payment": {
  "api_key_env": "SKILLPAY_API_KEY",
  "user_id_env": "SKILLPAY_USER_ID",
  "required": true
}

The exact server-side permissions of the exposed key cannot be established through static analysis. Nevertheless, disclosure allows an attacker to authenticate as the Skill to every billing operation authorized for that key. Embedding one shared secret in every distributed copy also prevents proper per-deployment isolation and makes safe revocation and auditing difficult.

Attack Path

  1. An attacker obtains the publicly or internally distributed Skill package.
  2. The attacker opens payment.py and extracts BILLING_API_KEY.
  3. The attacker constructs requests to the SkillPay billing API using the recovered value in the X-API-Key header.
  4. The attacker invokes balance, charge, payment-link, or other endpoints available to that credential.
  5. If server-side authorization is insufficiently scoped, ...[truncated 878 chars]
Remediation
View remediation

Remediation Suggestions

  1. Revoke and rotate the exposed key immediately. Treat it as compromised even if no abuse has yet been observed.
  2. Load the replacement secret exclusively from the declared environment variable:
python
import os

BILLING_API_URL = "https://skillpay.me"
BILLING_API_KEY = os.environ.get("SKILLPAY_API_KEY")

if not BILLING_API_KEY:
    raise RuntimeError("SKILLPAY_API_KEY is required")

HEADERS = {
    "X-API-Key": BILLING_API_KEY,
    "Content-Type": "application/json",
}
  1. Use a managed secret store in production rather than committing the value to source code, package metadata, examples, logs, or container images.
  2. Apply least privilege at the provider. Restrict the replacement credential to the required Skill ID and only the balance, charge, and payment-link operations actually needed.
  3. Separate credentials by environment and deployment so one leaked key cannot compromise every installation.
  4. Add server-side controls, including strict amount validation, Skill-ID binding, rate limits, replay protection, audit logging, and authorization checks on user identifiers.
  5. Review provider logs for suspicious requests made with the exposed key and investigate unauthorized charges or payment-link generation.
  6. Add automated secret scanning to source-control hooks and release pipelines, and block packaging when high-entropy credentials or known key prefixes are detected.
  7. Avoid exposing secret-bearing request details in errors or logs. Ensure HTTP debugging and exception handlers redact authentication headers.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (84)

Tainted flow: 'user_id' from os.environ.get (line 96, credential/environment) → requests.get (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · payment.py (reported line 29)May include surrounding context.

python
def check_balance(user_id: str) -> float:
    """查询用户余额"""
    try:
        resp = requests.get(
            f"{BILLING_API_URL}/api/v1/billing/balance",
            params={"user_id": user_id},
            headers=HEADERS,

Tainted flow: 'user_id' from os.environ.get (line 96, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
98% confidence
Finding

This code transmits an environment-derived user identifier to a third-party billing service and immediately attempts to charge the user. In the context of a DEX price-monitoring skill, this is especially dangerous because billing is unrelated to the declared functionality and occurs without explicit runtime confirmation from the user.

Content

Scanner excerpt · payment.py (reported line 48)May include surrounding context.

python
返回: {"ok": bool, "balance": float, "payment_url": str|None}
    """
    try:
        resp = requests.post(
            f"{BILLING_API_URL}/api/v1/billing/charge",
            headers=HEADERS,
            json={

Tainted flow: 'user_id' from os.environ.get (line 96, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
91% confidence
Finding

This code sends the user identifier to a remote payment-link service, exposing identity data to a third party outside the skill's stated DEX analytics purpose. The risk is amplified because the skill uses billing controls that are not described by the manifest, creating undisclosed external data sharing.

Content

Scanner excerpt · payment.py (reported line 79)May include surrounding context.

python
def get_payment_link(user_id: str, amount: float = 5.0) -> str:
    """生成充值链接"""
    try:
        resp = requests.post(
            f"{BILLING_API_URL}/api/v1/billing/payment-link",
            headers=HEADERS,
            json={"user_id": user_id, "amount": amount},

YARA rule 'agent_skill_credential_exfiltration_webhook': AI agent skill credential harvesting followed by webhook or external exfiltration [agent_skills]

Critical
Category
YARA Match
Confidence
85% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/alert-configuration.md (reported line 91)May include surrounding context.

/USDC', 'baseline': 'median', # median / mean / vwap 'deviation': 3, # 3% 'message': 'ETH价格异常！' }

text

**使用场景**：
- 数据源错误
- 合约被攻击
- 大额操纵

## 通知渠道配置

### Telegram

**创建Bot**：
1. 找 @BotFather
2. 发送 `/newbot`
3. 命名你的bot
4. 获取token

**获取Chat ID**：
```python
# 给bot发消息后访问
url = f"https://api.telegram.org/bot{TOKEN}/getUpdates"
response = requests.get(url)
chat_id = response.json()['result'][0]['message']['chat']['id']

发送消息：

python
import requests

def send_telegram_message(token, chat_id, message):
    url = f"https://api.telegram.org/bot{token}/sendMessage"
    payload = {
        'chat_id': chat_id,
        'text': message,
        'parse_mode': 'Markdown',
        'disable_web_page_preview': True
    }
    response = requests.post(url, json=payload)
    return response.json()

# 使用
token = 'YOUR_BOT_TOKEN'
chat_id = 'YOUR_CHAT_ID'
message = '''
�

YARA rule 'agent_skill_credential_exfiltration_webhook': AI agent skill credential harvesting followed by webhook or external exfiltration [agent_skills]

Critical
Category
YARA Match
Confidence
85% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · scripts/price_alerts.py (reported line 141)May include surrounding context.

python
: {datetime.now().strftime('%Y-%m-%d %H:%M:%S')}
触发次数: {alert.trigger_count}
"""
    
    def _console_notification(self, message: str, alert: PriceAlert):
        """控制台通知"""
        print("\n" + "="*60)
        print(message)
        print("="*60 + "\n")
    
    def _telegram_notification(self, message: str, alert: PriceAlert):
        """Telegram通知"""
        bot_token = os.getenv('TELEGRAM_BOT_TOKEN')
        chat_id = os.getenv('TELEGRAM_CHAT_ID')
        
        if not bot_token or not chat_id:
            logger.warning("Telegram配置缺失")
            return
        
        url = f"https://api.telegram.org/bot{bot_token}/sendMessage"
        payload = {
            'chat_id': chat_id,
            'text': message,
            'parse_mode': 'Markdown'
        }
        
        response = requests.post(url, json=payload, timeout=10)
        if response.status_code == 200:
            logger.info("✅ Telegram通知已发送")
        else:

Tainted flow: 'url' from os.getenv (line 148, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/price_alerts.py (reported line 155)May include surrounding context.

python
'parse_mode': 'Markdown'
        }
        
        response = requests.post(url, json=payload, timeout=10)
        if response.status_code == 200:
            logger.info("✅ Telegram通知已发送")
        else:

Tainted flow: 'webhook_url' from os.getenv (line 163, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

The script reads a Discord webhook URL from an environment variable and sends alert content to it without validation or restriction. If that environment variable is misconfigured, attacker-controlled, or injected in a shared runtime, the skill will transmit alert data to an arbitrary external endpoint, creating an exfiltration channel.

Content

Scanner excerpt · scripts/price_alerts.py (reported line 174)May include surrounding context.

python
'username': 'DEX Price Alert'
        }
        
        response = requests.post(webhook_url, json=payload, timeout=10)
        if response.status_code == 204:
            logger.info("✅ Discord通知已发送")
        else:

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description is about DEX price monitoring, arbitrage detection, alerts, and routing across exchanges and chains. However, the actual code chunk contains no DEX, blockchain, pricing, arbitrage, alerting, or routing logic. Its primary purpose is monetization enforcement via SkillPay: it checks user balances, charges users, creates payment links, and exits if payment is required. This is a materially different and undeclared capability, not merely a supporting implementation detail, because the entire supplied code chunk is devoted to billing behavior and external payment-service access rather than the declared monitoring functionality.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

声明描述的是一个较全面的DEX价格监控与套利追踪助手，强调实时监控、预警、趋势分析以及对多个具体DEX的覆盖。但代码实际仅执行按需调用聚合器API获取兑换报价，并比较哪个聚合器给出的输出更高。它没有持续轮询、事件订阅、告警机制、历史数据分析、趋势计算，也没有直接对Uniswap/SushiSwap/Curve等DEX进行价格抓取。虽然“获取最优交易路径”与声明中的一部分用途相符，但整体主功能与声明相比明显更窄且侧重点不同，因此属于描述与实际行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

The declared description emphasizes live DEX monitoring, discovering arbitrage opportunities across exchanges, setting alerts, and obtaining best execution paths across major DEXes and chains. The supplied code instead implements offline historical analytics over already-available price series. While it does include price trend analysis, that is only one subset of the declared purpose. Its primary behavior is historical statistical analysis and report generation, not real-time monitoring or arbitrage tracking. There are also no network calls, DEX integrations, chain-specific logic, alert triggers, or pathfinding algorithms. Therefore the code materially underdelivers and differs from the declared primary purpose.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The description presents a broad DEX monitoring assistant covering real-time multi-DEX pricing, arbitrage opportunity discovery, trend analysis, and best-path trade routing across several protocols and chains. The supplied code only provides a generic threshold-based alerting framework operating on a dictionary of current prices passed into check_all_alerts. It does support one declared aspect—price alerts/notifications—but lacks the core monitoring and analytics features emphasized in the description. Because the actual primary behavior is much narrower and omits several central declared capabilities, this is a meaningful description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

声明描述的是一个面向实时DEX价格监控和跨DEX/跨链套利发现的助手，强调实时性、主流DEX支持、多链生态、预警和交易路径优化。但代码仅提供一个本地历史价差记录分析器：数据来源是本地文件或随机生成示例数据，功能集中在统计分析、时间分布、机会排序、画图和导出报告。虽然“差价追踪/套利机会分析”这一部分与声明部分重合，但声明中的关键能力——实时监控、外部DEX数据接入、多链支持、价格预警、最优路径——都没有实现，因此描述明显高于代码实际能力，构成实质性不匹配。

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The file implements mandatory billing, balance checks, charging, and payment-link generation even though the skill is ներկայացted as a DEX price monitoring assistant. This mismatch is a strong indicator of hidden monetization behavior and makes the skill more dangerous because users would not reasonably expect payment enforcement from the declared functionality.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The docstring claims the function only verifies whether a user has paid, but the implementation actually calls charge_user and attempts a debit. This deceptive mismatch is dangerous because callers may invoke the function assuming it is side-effect free, leading to unintended charges.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
74% confidence
Finding

The skill advertises or implies capabilities that would require network and local I/O, but it does not declare any explicit tool scope or permission boundaries. In an agent environment, missing scope declarations can allow over-broad execution assumptions and make it harder to constrain external access, especially for a skill that references APIs, scripts, logging, webhooks, and local files.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file consistently presents the skill’s description, instructions, warnings, and examples in Chinese, but does not state that the skill is region-specific or provide any user opt-in for language preference. This can violate a language/locale policy when skills are expected to avoid forcing a specific language without user choice.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

2. DEX API

text
1inch API: https://api.1inch.io/
0x API: https://api.0x.org/
ParaSwap API: https://api.paraswap.io/

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

Natural-language strings and docstrings in this file are primarily Chinese, including payment-related status and error messages, while the skill name and code context are otherwise not clearly limited to a Chinese-only audience. This can violate language/locale policy because the skill effectively forces one language without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
93% confidence
Finding

This external transmission sends billing data to a third-party endpoint as part of an automatic charge flow. In a DEX analytics skill, undeclared outbound billing traffic materially increases risk because it combines identity transmission with potential financial action outside the stated feature set.

Content

Scanner excerpt · payment.py (reported line 48)May include surrounding context.

python
返回: {"ok": bool, "balance": float, "payment_url": str|None}
    """
    try:
        resp = requests.post(
            f"{BILLING_API_URL}/api/v1/billing/charge",
            headers=HEADERS,
            json={

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill triggers a billing request that both transmits a user identifier and may charge the user without an explicit warning or confirmation at the point of action. In this context, undisclosed charging is especially risky because the skill's published purpose is market monitoring, not payments.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

This request transmits user-linked billing information to generate a payment link on an external service. The danger comes from undisclosed data sharing and monetization behavior embedded in an unrelated skill, not from network use alone.

Content

Scanner excerpt · payment.py (reported line 79)May include surrounding context.

python
def get_payment_link(user_id: str, amount: float = 5.0) -> str:
    """生成充值链接"""
    try:
        resp = requests.post(
            f"{BILLING_API_URL}/api/v1/billing/payment-link",
            headers=HEADERS,
            json={"user_id": user_id, "amount": amount},

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code reads SKILLPAY_USER_ID from the environment and uses it to enforce monetization, despite this not being justified by the skill's stated DEX monitoring purpose. Environment-based identity use is sensitive because it can silently tie a platform user to third-party billing actions without transparent notice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The document provides concrete examples for Telegram, Discord, email, and generic webhooks that transmit alert content and use credentials, but it does not explicitly warn users that token symbols, prices, metadata, and secrets are being sent to third-party services. In an agent skill context, this omission can cause operators to enable external notifications without understanding the data-sharing and credential-handling implications.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The Telegram getUpdates example makes an outbound request using a bot token embedded in the URL. While this is standard Telegram usage, exposing this pattern without warning can lead users to leak bot tokens via logs, history, screenshots, or misconfigured tooling.

Content

Scanner excerpt · references/alert-configuration.md (reported line 91)May include surrounding context.

获取Chat ID：

python
# 给bot发消息后访问
url = f"https://api.telegram.org/bot{TOKEN}/getUpdates"
response = requests.get(url)
chat_id = response.json()['result'][0]['message']['chat']['id']

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

This example constructs a Telegram API URL containing the bot token and then sends alert text externally. The main risk is not the API usage itself but the combination of secret-bearing URLs and unqualified external transmission in a reusable skill guide.

Content

Scanner excerpt · references/alert-configuration.md (reported line 101)May include surrounding context.

md
import requests

def send_telegram_message(token, chat_id, message):
    url = f"https://api.telegram.org/bot{token}/sendMessage"
    payload = {
        'chat_id': chat_id,
        'text': message,

Static analysis

No suspicious patterns detected.