ClawHub
Back to skill

Security audit

Token Vesting

Security checks for vulnerabilities and agentic risk

Overview

This skill is relevant to Sablier vesting, but it should be reviewed carefully because it can drive real blockchain transactions and gives unsafe or incomplete guidance around private keys and irreversible actions.

Install only if you are comfortable with an agent preparing real on-chain transactions. Prefer a hardware wallet or encrypted Foundry keystore, verify every chain, contract, token, recipient, amount, allowance, stream ID, and calldata before broadcasting, and avoid using a production private key through --private-key $ETH_PRIVATE_KEY. Treat renounce as permanent and require an explicit confirmation before running it.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:59
Finding

Private Key Exposure Through Process Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 59-65; the unsafe signing pattern is repeated at lines 151, 189, 205, 218, 245, 279, 314, 325, 336, and 424.
Vulnerability Type: Private key disclosure through shell argument expansion
Risk Level: High

Vulnerable Code

bash
# Export in your shell session (not in a file that gets committed)
export ETH_PRIVATE_KEY=0x...

# Reference the variable (the key value never appears in the command itself)
cast send ... --private-key $ETH_PRIVATE_KEY

The same unsafe alternative is repeatedly recommended in transaction examples:

bash
# Or: --ledger | --trezor | --private-key $ETH_PRIVATE_KEY

Technical Analysis

The statement that the private key “never appears in the command itself” is misleading. Although shell history normally records the literal variable reference, the shell expands $ETH_PRIVATE_KEY before invoking cast. The resulting private key is therefore supplied to the child process as a command-line argument.

Depending on operating-system configuration, process arguments may be observable through process inspection interfaces, monitoring or endpoint-security software, command wrappers, debugging tools, audit logs, and crash diagnostics. Any process or user with sufficient local visibility during transaction signing could capture the expanded key.

This is particularly severe because the Skill is designed for blockchain transactions involving token approvals and vesting contracts. A private key is a reusable bearer credential rather than a transaction-scoped secret.

Attack Path

  1. A user follows the Skill instructions and exports a funded wallet key as ETH_PRIVATE_KEY.
  2. The user executes a documented command containing --private-key $ETH_PRIVATE_KEY.
  3. The shell expands the variable and launches cast with the raw private key in its process argument vector.
  4. A malicious or compromised local process, monito ...[truncated 983 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove --private-key $ETH_PRIVATE_KEY from all command examples and do not describe environment-variable expansion as preventing argument exposure.
  2. Require hardware-wallet signing through --ledger or --trezor for production and mainnet transactions.
  3. Recommend an encrypted Foundry keystore with --account <name> as the default software-based signing method.
  4. If environment-based signing must remain available, clearly warn that passing the variable to a command-line option exposes its expanded value through the process argument vector.
  5. Use a signer integration that reads credentials through a protected keystore, hardware device, operating-system credential facility, or another channel that does not place secrets in command-line arguments.
  6. Advise users who have already followed these instructions to assess local telemetry exposure and rotate potentially compromised production keys.

T08 · Insecure Dependencies

Warning
Location
SKILL.md:356
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 356-361
Vulnerability Type: Unpinned executable dependency and non-reproducible supply-chain resolution
Risk Level: Medium

Vulnerable Code

markdown
### Install dependency

```bash
forge init sablier-vesting && cd sablier-vesting
bun add @sablier/lockup
text

### Technical Analysis

The installation command does not specify an exact reviewed version of `@sablier/lockup`. Consequently, the package manager may resolve different package contents at different times according to the current registry state and applicable version-selection behavior.

The instruction also does not require a reviewed lockfile, frozen dependency resolution, integrity verification, or lifecycle-script review. This weakens build reproducibility and creates a supply-chain exposure: compromise of the package, one of its transitive dependencies, its publishing account, or the package registry could cause users to retrieve unreviewed code.

This issue is especially relevant because the dependency is used to compile scripts that approve token spending and create blockchain streams. A malicious or incompatible dependency could alter imported interfaces, compilation behavior, or generated transaction logic. Package installation may also execute lifecycle behavior from the resolved dependency graph where supported and enabled.

No evidence shows that the named package is currently malicious. The vulnerability is the unsafe, mutable dependency-resolution procedure.

### Attack Path

1. An attacker compromises an upstream package, transitive dependency, maintainer publishing credential, or relevant registry distribution path.
2. A malicious or altered version becomes eligible for resolution under the unpinned `bun add @sablier/lockup` command.
3. A user follows the Skill and installs the dependency without comparing it against a reviewed lockfile or expected integrity value
...[truncated 1036 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin @sablier/lockup to a specific reviewed version rather than relying on mutable package resolution.
  2. Commit the generated lockfile and require installation with Bun’s frozen-lockfile mode in reproducible environments.
  3. Review the selected package, its transitive dependencies, and any lifecycle scripts before using it in a wallet-enabled workflow.
  4. Verify package provenance and integrity against trusted upstream release information.
  5. Perform dependency installation and compilation in a restricted environment without production private keys or unnecessary filesystem credentials.
  6. Require transaction simulation and explicit verification of contract address, chain ID, token, recipient, amount, allowance, and calldata before broadcasting.
  7. Establish a controlled dependency-update process that includes source review, automated scanning, testing, and lockfile-diff approval.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Session Persistence

Medium
Category
Rogue Agent
Confidence
83% confidence
Finding

The skill metadata declares a primary signing secret (ETH_PRIVATE_KEY) and operational environment (ETH_RPC_URL) for a tool that can approve tokens, create vesting streams, cancel streams, and renounce rights on-chain. In this context, session-available signing material materially increases risk because any prompt-injection, tool misuse, or authorization mistake can immediately result in real blockchain transactions affecting user funds.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: sablier-vesting
description: Create and manage token vesting streams using the Sablier Lockup protocol (linear, dynamic, tranched).
homepage: https://docs.sablier.com
disable-model-invocation: true
metadata: {"openclaw":{"emoji":"⏳","requires":{"anyBins":["cast","forge"],"env":["ETH_RPC_URL"]},"primaryEnv":"ETH_PRIVATE_KEY"}}

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md
### Agent Behavioral Constraints

1. **NEVER ask the user to paste a private key into the chat.** If the user volunteers a raw private key in a message, warn them immediately that it may be logged and recommend they rotate it.
2. **NEVER embed a raw private key in any command you execute.** Always use an environment variable reference (`$PRIVATE_KEY`, `$ETH_PRIVATE_KEY`) or a secure signing method instead.
3. **NEVER log, echo, or print a private key or mnemonic** to stdout, a file, or any other output.
4. **Always recommend the safest available signing method**, in this order of preference:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill documents an irreversible renounce(uint256) operation without requiring an explicit confirmation step or warning that the action permanently removes the sender’s ability to cancel the stream. In a high-value token vesting context, an agent following this guidance could execute a one-way transaction from an ambiguous or casual user request, causing permanent loss of administrative control over unvested funds.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.