Crypto Analytics

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:46 AM UTC
• Version: 1.0.3

Overview

This blockchain lookup skill mostly does what it says, but it automatically reads a workspace .env file, which can expose unrelated secrets to the skill process.

Review this before installing if your workspace .env contains API keys or other secrets. Prefer providing only ETHERSCAN_API_KEY explicitly to the process, keep unrelated credentials out of the workspace .env, and be aware that wallet addresses and transaction hashes you query are sent to Etherscan, Blockchair, or public Solana RPC endpoints and cached locally for a short time.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared description presents a broad blockchain analytics capability spanning balances, transactions, validation, and chain support across many networks. The supplied code only validates address formats using regex and normalizes addresses locally. It recognizes Ethereum-style addresses, Bitcoin, and Solana, but does not actually implement multi-chain analytics, Etherscan integration, blockchain queries, or broad 60+ chain support. While address validation is part of the declared purpose, the actual code chunk is materially narrower than the declared functionality, so this is a mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The code largely matches the stated blockchain analytics purpose: it fetches wallet balances, transaction history, and transaction details for EVM chains, Bitcoin, and partially Solana. However, it also includes several materially additional capabilities not mentioned in the description: gas price lookup, ERC-20 token balance queries, token metadata lookups, ERC-20 transfer history, wallet token inventory discovery, and Solana SPL token account enumeration. These are functional end-user capabilities, not merely internal implementation details. Additionally, while the description explicitly advertises address validation and listing supported chains, this specific code chunk only uses an imported AddressValidator for normalization and contains a list_supported_chains method on EtherscanV2API without showing it as part of the unified interface or CLI. So the description is directionally accurate but incomplete and somewhat overstates exposed validation support in this chunk.

Credential Access

High

• Category: Privilege Escalation

Content

homepage: https://clawhub.com/skills/crypto-analytics
repository: https://github.com/yourusername/crypto-analytics
description: "Multi-chain blockchain analytics for wallet balances, transaction history, and address validation. Supports 60+ EVM chains via Etherscan V2, plus Bitcoin and Solana. Use to check wallet balances, view transactions, get transaction details, validate addresses, or list supported chains."
changelog: "v1.0.3: Fixed privacy section to accurately describe local caching (may store queried addresses). Improved .env loading to only use workspace root (AGENTS.md/.git detection). v1.0.2: Published version before false-positive appeal. v1.0.1: Added missing 'tokens' command handler. Fixed CHAINS typo in get_wallet_tokens."
---

# Crypto Analytics

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

homepage: https://clawhub.com/skills/crypto-analytics
repository: https://github.com/yourusername/crypto-analytics
description: "Multi-chain blockchain analytics for wallet balances, transaction history, and address validation. Supports 60+ EVM chains via Etherscan V2, plus Bitcoin and Solana. Use to check wallet balances, view transactions, get transaction details, validate addresses, or list supported chains."
changelog: "v1.0.3: Fixed privacy section to accurately describe local caching (may store queried addresses). Improved .env loading to only use workspace root (AGENTS.md/.git detection). v1.0.2: Published version before false-positive appeal. v1.0.1: Added missing 'tokens' command handler. Fixed CHAINS typo in get_wallet_tokens."
---

# Crypto Analytics

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

homepage: https://clawhub.com/skills/crypto-analytics
repository: https://github.com/yourusername/crypto-analytics
description: "Multi-chain blockchain analytics for wallet balances, transaction history, and address validation. Supports 60+ EVM chains via Etherscan V2, plus Bitcoin and Solana. Use to check wallet balances, view transactions, get transaction details, validate addresses, or list supported chains."
changelog: "v1.0.3: Fixed privacy section to accurately describe local caching (may store queried addresses). Improved .env loading to only use workspace root (AGENTS.md/.git detection). v1.0.2: Published version before false-positive appeal. v1.0.1: Added missing 'tokens' command handler. Fixed CHAINS typo in get_wallet_tokens."
---

# Crypto Analytics

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

from decimal import Decimal
from address_validator import AddressValidator

# Optional: load .env from workspace root if python-dotenv is installed
try:
    from dotenv import load_dotenv
    # Find OpenClaw workspace root by looking for AGENTS.md or .git

• Confidence: 90% confidence
• Finding: Automatic discovery and loading of a workspace .env file can expose the skill to credentials unrelated to its narrow function, including tokens for other tools in the same workspace. Even if the code currently uses only ETHERSCAN_API_KEY, expanding secret visibility inside an agent skill is dangerous because it violates least privilege and creates opportunities for accidental leakage or future abuse.

Credential Access

High

• Category: Privilege Escalation

Content

p = p.parent
        return Path(__file__).parent  # fallback
    workspace_root = find_workspace_root()
    env_path = workspace_root / '.env'
    if env_path.exists():
        load_dotenv(dotenv_path=env_path)
except ImportError:

• Confidence: 90% confidence
• Finding: The explicit load of workspace_root/.env grants this script access to any secrets stored there, which is broader than necessary for blockchain analytics. In agent ecosystems, this kind of ambient credential access materially raises risk because other components may later log, return, or misuse values now present in the environment.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence
• Finding: The skill advertises network access, local caching, and optional environment-variable use, but it does not declare any explicit tool scope such as allowed tools or permissions. That omission weakens reviewability and least-privilege controls, making it harder for operators to understand that the skill can read env data, write cache files, and call external services. In a skill that reaches the network and writes local files, undeclared scope is a real security concern even if the described behavior appears legitimate.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The function docstring says it checks whether an EVM address is a contract, but the implementation is a stub that always returns False. In a blockchain analytics skill, callers may rely on this result for security-sensitive decisions such as classifying wallets, filtering counterparties, or skipping contract interactions, which can cause incorrect trust decisions and misanalysis.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The manifest says the skill is for wallet balances, transaction history, transaction details, address validation, and listing supported chains. This file also exposes gas price retrieval plus ERC-20/SPL token-specific balance and transfer enumeration, which are materially broader analytics capabilities than the stated manifest scope.

Description-Behavior Mismatch

Medium

• Confidence: 79% confidence
• Finding: The manifest explicitly advertises address validation as a user-facing capability. In this file, AddressValidator is only used internally to normalize token and owner addresses for EVM calls, and there is no public method to validate arbitrary addresses for users across the advertised chains.

External Transmission

Medium

• Category: Data Exfiltration

Content

class EtherscanV2API:
    """Etherscan V2 - Unified API for 60+ chains"""

    BASE_URL = "https://api.etherscan.io/v2/api"
    # Rate limits depend on API key tier, but free: 5 calls/sec

    # Chain ID mapping

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

class EtherscanV2API:
    """Etherscan V2 - Unified API for 60+ chains"""

    BASE_URL = "https://api.etherscan.io/v2/api"
    # Rate limits depend on API key tier, but free: 5 calls/sec

    # Chain ID mapping

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

class EtherscanV2API:
    """Etherscan V2 - Unified API for 60+ chains"""

    BASE_URL = "https://api.etherscan.io/v2/api"
    # Rate limits depend on API key tier, but free: 5 calls/sec

    # Chain ID mapping

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: This code sends user-supplied wallet addresses and other query data to Etherscan via an HTTP request, which is a network operation involving potentially sensitive user data. While the module docstring describes the API client generally, there is no visible confirmation prompt or user-facing disclosure near the request path warning that address lookups are sent to third-party services.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The Blockchair client performs external HTTP requests using user-provided addresses and transaction identifiers, which can reveal user interests or wallet data to a third-party service. The code lacks a nearby user-facing warning, confirmation, or CLI disclosure explaining that these lookups leave the local environment.

External Transmission

Medium

• Category: Data Exfiltration

Content

}

        try:
            resp = requests.post(self.endpoint, json=payload, timeout=30)
            resp.raise_for_status()
            data = resp.json()

• Confidence: 80% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This method sends wallet addresses and request payloads to public Solana RPC endpoints, which is a privacy-relevant network operation. The file does not provide a user-facing warning or confirmation that account lookups are performed against third-party public infrastructure.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The manifest says the skill supports transaction history and transaction details across its stated chains, including Solana. In code, Solana transaction history returns a hard-coded error, and elsewhere Solana transaction details are also rejected rather than implemented, so the advertised capability does not match actual behavior.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The documentation instructs users to create a .env file with API keys but does not warn them to keep it out of version control or avoid exposing credentials. This omission can lead to accidental key leakage through commits, screenshots, or shared workspaces, especially by less experienced users following setup steps verbatim.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: This code file performs external API/RPC lookups through CryptoAPIClient for wallet and transaction data, but the command handlers themselves provide no visible user-facing warning, prompt, or runtime notice that user-supplied addresses and transaction hashes will be sent to third-party providers. The only related note is embedded in returned metadata for the 'chains' command, not as an operational disclosure for these commands.

Intent-Code Divergence

Low

• Confidence: 71% confidence
• Finding: The returned note says 'No API keys required for basic usage,' which is stronger than what this file demonstrates. The code merely reports provider names and rate limits; it does not enforce or verify a no-key operation mode, so the inline documentation can mislead consumers about how the skill actually works.

Context-Inappropriate Capability

Low

• Confidence: 90% confidence
• Finding: This code traverses parent directories to locate and load a workspace-wide .env file, expanding the skill's access to secrets beyond what is needed for blockchain lookups. In an agent environment, that behavior increases the blast radius of the skill and can unintentionally ingest unrelated credentials from the surrounding workspace.

Static analysis

No suspicious patterns detected.