Security audit

Onchor Clawhub

Security checks for vulnerabilities and agentic risk

Overview

This skill is not plainly malicious, but it needs review because it asks agents to store a powerful account token in memory and can spend or withdraw USDC and change marketplace listings.

Install only if you are comfortable giving the skill access to an Onchor account that can spend funds, manage listings, update payout details, and withdraw USDC. Do not store the `oat_` token in general chat memory or notes; use a proper secret store if available, pin and verify any CLI/MCP package before running it, and require explicit owner approval for purchases, paid calls, listing deletion, payout changes, and withdrawals.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:24
Finding: Unpinned Third-Party Package Is Downloaded and Executed
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:24-40
Vulnerability Type: Unpinned npm dependency installation and execution
Risk Level: High

Vulnerable Code:

bash
npm install -g onchor onchor init my-agent # register + get wallet + oat_ token onchor browse # discover APIs onchor browse --slug token-scanner # details + plans onchor subscribe token-scanner --plan free # subscribe onchor call token-scanner /scan --token TOKEN_MINT # call onchor balance # check USDC balance

json
{ "mcpServers": { "onchor": { "command": "npx", "args": ["onchor", "mcp"] } } }

Technical Analysis

The Skill instructs users to globally install onchor without an exact version or integrity constraint. It also configures npx to execute the package without pinning a reviewed release. Both commands resolve package content at execution time, so the code that runs can differ from the code available when the Skill was audited.

A global npm installation may execute package lifecycle scripts with the permissions of the invoking user. Likewise, npx can download and immediately run a package that is not already installed. The project provides no lockfile, integrity hash, provenance verification, source review instructions, or restriction on npm lifecycle scripts.

This is a supply-chain weakness rather than evidence that the current onchor package is malicious. Exploitation depends on a malicious publication, registry compromise, maintainer compromise, or package-resolution attack.

Attack Path

An attacker compromises the package publisher or registry account, or causes an unsafe package version to be resolved.

The attacker publishes a modified onchor release containing a malicious lifecycle script, CLI implementation, or MCP server.

An agent follows the Skill and runs npm install -g onchor or starts the unpinned package through npx.

npm ret ...[truncated 1221 chars]
Remediation: View remediation
Remediation Suggestions

Pin the package to a specific, reviewed version, such as onchor@2.0.0, rather than resolving the latest release.

Publish and verify the package integrity hash and package provenance before execution.

Use a project-local dependency and committed lockfile instead of a global installation.

Configure MCP to invoke an already installed, verified binary rather than allowing npx to download code implicitly.

Use npx --no-install where appropriate so startup fails if the reviewed package is unavailable locally.

Disable npm lifecycle scripts during installation when they are unnecessary, then review any required scripts separately.

Run the CLI and MCP server in a sandbox with minimal filesystem, network, environment-variable, and wallet access.

Document the official npm package scope, publisher identity, source repository, signing or provenance process, and supported integrity values.

Require explicit review before dependency upgrades rather than automatically trusting future releases.

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:50
Finding: Bearer Credential Is Persisted in General-Purpose Agent Memory
Content: View full analysis
Vulnerability Details

File Location: SKILL.md:50-80 and SKILL.md:373-381
Vulnerability Type: Insecure plaintext credential storage guidance
Risk Level: High

Vulnerable Code:

text
### Step 0 — Check if you're already registered Look in your memory/notes for an existing `oat_` token from a previous session. If found, verify it:

bash
curl -s https://api.onchor.xyz/api/agents/me \ -H "X-API-Key: oat_YOUR_TOKEN"

text
**Save `agent_token` to your memory/notes immediately.** You need it for every authenticated request. Use it as `X-API-Key` header.

text
- Your owner can claim your account via the Onchor dashboard using your `oat_` token - Always save your `oat_` token to memory so you don't re-register

Technical Analysis

The Skill explicitly directs the agent to save and retrieve the oat_ bearer token through general-purpose memory or notes. Such storage is not established as an encrypted credential vault and may be included in future prompt context, logs, exports, backups, debugging traces, or shared agent state.

The token is used directly as an X-API-Key bearer credential. Possession therefore appears sufficient to authenticate requests without a second factor or request-specific proof. The document also states that the token can be used by the owner to claim the account, increasing the sensitivity of disclosure.

The Skill does not prescribe encryption, access control, token scoping, expiration, rotation, redaction, revocation, or isolation from untrusted Skills and prompts. Although the token is not hardcoded in the repository, the prescribed runtime storage practice creates a credential-exposure risk.

Attack Path

The agent registers with Onchor and receives an oat_ token.

Following the Skill, the agent writes the token into persistent memory or notes.

The token becomes available through memory retrieval, shared context, log ...[truncated 1398 chars]
Remediation: View remediation
Remediation Suggestions

Remove all instructions to store the token in conversational memory, notes, prompt context, or other general-purpose state.

Store the token in an operating-system keychain, hardware-backed secret manager, or dedicated MCP credential store with encryption at rest.

Inject the credential only into the specific Onchor process or request that requires it; do not expose it to unrelated Skills or tools.

Redact the token from command output, logs, traces, crash reports, memory exports, and support bundles.

Issue short-lived, revocable, least-privilege tokens with separate scopes for browsing, purchases, selling, account changes, and withdrawals.

Require explicit owner approval and strong secondary authentication for withdrawals, payout-wallet changes, and account claiming.

Provide token rotation and immediate revocation procedures, including automatic revocation when accidental disclosure is detected.

Add spending limits, withdrawal allowlists, transaction notifications, and anomaly detection to reduce financial impact.

Avoid placing secrets directly in shell command history. Use protected environment injection or a secure client that constructs authentication headers internally.

Document who can access persistent agent state and ensure that untrusted prompts, Skills, and users cannot retrieve stored credentials.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (32)

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 9)May include surrounding context.
md
openclaw: requires: bins: - curl emoji: "\u2693" homepage: https://onchor.xyz ---

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.
If found, verify it:

bash
curl -s https://api.onchor.xyz/api/agents/me \ -H "X-API-Key: oat_YOUR_TOKEN"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.
If found, verify it:

bash
curl -s https://api.onchor.xyz/api/agents/me \ -H "X-API-Key: oat_YOUR_TOKEN"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.
If found, verify it:

bash
curl -s https://api.onchor.xyz/api/agents/me \ -H "X-API-Key: oat_YOUR_TOKEN"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 94)May include surrounding context.
If found, verify it:

bash
curl -s https://api.onchor.xyz/api/agents/me \ -H "X-API-Key: oat_YOUR_TOKEN"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.
If found, verify it:

bash
curl -s https://api.onchor.xyz/api/agents/me \ -H "X-API-Key: oat_YOUR_TOKEN"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.
If found, verify it:

bash
curl -s https://api.onchor.xyz/api/agents/me \ -H "X-API-Key: oat_YOUR_TOKEN"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.
If found, verify it:

bash
curl -s https://api.onchor.xyz/api/agents/me \ -H "X-API-Key: oat_YOUR_TOKEN"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.
If found, verify it:

bash
curl -s https://api.onchor.xyz/api/agents/me \ -H "X-API-Key: oat_YOUR_TOKEN"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.
If found, verify it:

bash
curl -s https://api.onchor.xyz/api/agents/me \ -H "X-API-Key: oat_YOUR_TOKEN"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.
If found, verify it:

bash
curl -s https://api.onchor.xyz/api/agents/me \ -H "X-API-Key: oat_YOUR_TOKEN"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.
If found, verify it:

bash
curl -s https://api.onchor.xyz/api/agents/me \ -H "X-API-Key: oat_YOUR_TOKEN"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.
If found, verify it:

bash
curl -s https://api.onchor.xyz/api/agents/me \ -H "X-API-Key: oat_YOUR_TOKEN"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.
If found, verify it:

bash
curl -s https://api.onchor.xyz/api/agents/me \ -H "X-API-Key: oat_YOUR_TOKEN"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.
If found, verify it:

bash
curl -s https://api.onchor.xyz/api/agents/me \ -H "X-API-Key: oat_YOUR_TOKEN"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.
If found, verify it:

bash
curl -s https://api.onchor.xyz/api/agents/me \ -H "X-API-Key: oat_YOUR_TOKEN"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 180)May include surrounding context.
If found, verify it:

bash
curl -s https://api.onchor.xyz/api/agents/me \ -H "X-API-Key: oat_YOUR_TOKEN"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 217)May include surrounding context.
If found, verify it:

bash
curl -s https://api.onchor.xyz/api/agents/me \ -H "X-API-Key: oat_YOUR_TOKEN"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 232)May include surrounding context.
If found, verify it:

bash
curl -s https://api.onchor.xyz/api/agents/me \ -H "X-API-Key: oat_YOUR_TOKEN"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 250)May include surrounding context.
If found, verify it:

bash
curl -s https://api.onchor.xyz/api/agents/me \ -H "X-API-Key: oat_YOUR_TOKEN"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 271)May include surrounding context.
If found, verify it:

bash
curl -s https://api.onchor.xyz/api/agents/me \ -H "X-API-Key: oat_YOUR_TOKEN"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 275)May include surrounding context.
If found, verify it:

bash
curl -s https://api.onchor.xyz/api/agents/me \ -H "X-API-Key: oat_YOUR_TOKEN"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 281)May include surrounding context.
If found, verify it:

bash
curl -s https://api.onchor.xyz/api/agents/me \ -H "X-API-Key: oat_YOUR_TOKEN"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 285)May include surrounding context.
If found, verify it:

bash
curl -s https://api.onchor.xyz/api/agents/me \ -H "X-API-Key: oat_YOUR_TOKEN"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 291)May include surrounding context.
If found, verify it:

bash
curl -s https://api.onchor.xyz/api/agents/me \ -H "X-API-Key: oat_YOUR_TOKEN"

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T08 · Insecure Dependencies

Vulnerability Details

Technical Analysis

Attack Path

Remediation Suggestions

T09 · Insecure Skill Coding Practices

Vulnerability Details

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

External Transmission

Static analysis