Clanker

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:26 AM UTC
• Version: 1.0.0

Overview

This skill is meant for crypto token deployment, but it handles wallet keys and irreversible mainnet transactions with insufficient safeguards.

Review carefully before installing. Use only throwaway testnet keys until the key handling, file permissions, dependency pinning, contract addresses, and explicit pre-transaction confirmation are fixed. Do not use a funded mainnet wallet with this version unless you fully accept the risk of key exposure and irreversible ETH spending.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/clanker.sh:318

Finding

Wallet Private Key Exposed Through Process Command-Line Arguments

Content

View full analysis

/cmdline`, `ps`, process-monitoring agents, audit logs, crash diagnostics, or endpoint telemetry, the complete private key may become visible outside the deployment process. The deployment helper may remain active while waiting up to 120 seconds for a transaction receipt, increasing the observation window. Although `deploy.py` signs transactions locally and transmits only signed transactions to the RPC endpoint, that protection is undermined by exposing the signing key in the local process metadata. Passing the arguments as a quoted array prevents shell command injection, but quoting does not protect the key from process-list disclosure. ### Attack Path 1. A user configures a funded Base wallet and invokes `clanker.sh deploy` or `clanker.sh testnet-deploy`. 2. `clanker.sh` extracts the complet ...[truncated 1355 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/test.sh:16

Finding

Plaintext Wallet Configuration Is Created Without Restrictive File Permissions

Content

View full analysis

"$CONFIG_FILE" << 'EOF' { "mainnet": { "rpc_url": "https://1rpc.io/base", "private_key": "PLACEHOLDER" }, "testnet": { "rpc_url": "https://base-sepolia.public.blastapi.io", "private_key": "PLACEHOLDER" } } EOF echo "Created test config at $CONFIG_FILE" fi ``` The documented production configuration uses the same plaintext format: ```json { "mainnet": { "rpc_url": "https://1rpc.io/base", "private_key": "YOUR_PRIVATE_KEY" }, "testnet": { "rpc_url": "https://sepolia.base.org", "private_key": "YOUR_TESTNET_PRIVATE_KEY" } } ``` ### Technical Analysis The test script creates the configuration with ordinary shell redirection but does not set a restrictive `umask`, apply `chmod 600`, or validate ownership and permissions before later reading the file. Under a common `umask` of `022`, the file is created with mode `0644`, making it readable by other local users. The initially generated file contains placeholders, not real secrets. However, the documented workflow instructs users to place real mainnet and testnet private keys in this same file. If a user edits the generated file, its original permissive mode normally remains unchanged. The runtime also accepts existing configuration files without checking whether they are symlinks, owned by the current user, or accessible by group and other users. ### Attack Path 1. The user runs `scripts/test.sh`, which creates `~/.clawdbot/skills/clanker/config.json` using the current default `umask`. 2. The resulting file may be readable by group members or all local users. 3. The user follows the setup instructions and r ...[truncated 950 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: SKILL.md:43

Finding

Unpinned Third-Party Python Dependencies Installed from Mutable Package Sources

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The documented behavior does not match the reported implementation: private key handling differs, deployment is reportedly done through direct contract/web3 calls rather than a higher-level SDK, and there is additional undeclared transaction behavior. For a blockchain deployment skill handling private keys and funds, this mismatch is dangerous because operators may authorize actions under false assumptions, leading to unintended transactions, fund movement, or key exposure.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/clanker.sh (reported line 107)May include surrounding context.

sh

local params="$2"
    local rpc_url="$3"
    
    curl -s -X POST "$rpc_url" \
        -H "Content-Type: application/json" \
        -d "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"$method\",\"params\":$params}" \
        | python3 -c "import sys,json; print(json.load(sys.stdin).get('result','0x'))"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/clanker.sh (reported line 119)May include surrounding context.

sh

local network="$2"
    local rpc_url=$(get_rpc_url "$network")
    
    local receipt=$(curl -s -X POST "$rpc_url" \
        -H "Content-Type: application/json" \
        -d "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"eth_getTransactionReceipt\",\"params\":[\"$txhash\"]}")

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill documents use of shell, file, and environment-dependent behavior but does not declare any explicit tool scope or permissions boundaries. In an agent setting, this can cause the skill to run with broader capabilities than users expect, increasing the chance of unintended file access, secret exposure, or command execution during token deployment workflows.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 84% confidence

Finding

The skill instructs users to store persistent private keys in a config file under the home directory, creating session-persistent secret material on disk. In an agent ecosystem with file access, persistent wallet keys materially raise the impact of compromise because later runs, other skills, or local malware could read and misuse them to sign transactions.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: clanker
description: Deploy ERC20 tokens on Base using Clanker SDK. Create tokens with built-in Uniswap V4 liquidity pools. Supports Base mainnet and Sepolia testnet. Requires PRIVATE_KEY in config.
metadata: {"clawdbot":{"emoji":"🪙","homepage":"https://clanker.world","requires":{"bins":["curl","jq","python3"]}}}
---

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest advertises token deployment support, but the body of the documentation later states deployment is only a placeholder and direct deployment is not implemented. This inconsistency can mislead users or downstream agents into attempting high-risk financial operations with an incomplete or nonfunctional workflow, which is especially risky in a crypto context.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The usage section presents deploy commands as if they are operational, while later notes say deployment is placeholder-only and not implemented. This contradiction can cause users or agents to trust unsafe or nonexistent behavior, potentially resulting in mistaken execution attempts, confusion around transaction signing, or reliance on incomplete deployment logic.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 87% confidence

Finding

The testing guide explicitly tells users to write a private key into a persistent file in ~/.clawdbot/skills/clanker/config.json. This creates durable sensitive material in a predictable location, making credential theft and unauthorized transaction signing more likely if the host or agent environment is compromised.

Content

Scanner excerpt · SKILL.md (reported line 147)May include surrounding context.

Step 1: Set Up Testnet Config

bash

# Create config with testnet private key
cat > ~/.clawdbot/skills/clanker/config.json << 'EOF'
{
  "testnet": {

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/clanker-sdk.md (reported line 61)May include surrounding context.

md

- Base Mainnet: ~0.01 - 0.05 ETH gas (varies with network usage)
- Base Sepolia: Free (testnet)

## Common Operations via curl

### Get Token Info (ERC20 ABI)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/clanker.sh (reported line 107)May include surrounding context.

sh

local params="$2"
    local rpc_url="$3"
    
    curl -s -X POST "$rpc_url" \
        -H "Content-Type: application/json" \
        -d "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"$method\",\"params\":$params}" \
        | python3 -c "import sys,json; print(json.load(sys.stdin).get('result','0x'))"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/clanker.sh (reported line 119)May include surrounding context.

sh

local params="$2"
    local rpc_url="$3"
    
    curl -s -X POST "$rpc_url" \
        -H "Content-Type: application/json" \
        -d "{\"jsonrpc\":\"2.0\",\"id\":1,\"method\":\"$method\",\"params\":$params}" \
        | python3 -c "import sys,json; print(json.load(sys.stdin).get('result','0x'))"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The deploy and testnet-deploy paths invoke the deployment helper with a configured private key and no explicit confirmation, dry-run, or irreversible-action warning. In this skill’s context, that means a user or upstream agent can trigger real blockchain transactions and spend funds immediately, which is especially risky on mainnet because transactions are irreversible and may create unwanted contracts or liquidity positions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The skill instructs users to persist private keys in a long-lived plaintext config file under ~/.clawdbot/skills/clanker/config.json. Storing signing keys unencrypted on disk materially increases the chance of wallet compromise through local malware, accidental disclosure, backups, or overly permissive file permissions.

Content

Scanner excerpt · scripts/clanker.sh (reported line 371)May include surrounding context.

sh

$0 info 0xabcd... --network testnet

Setup:
    Create ~/.clawdbot/skills/clanker/config.json with RPC and private keys.
    See SKILL.md for configuration details.

EOF

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

When initial_lp_eth > 0, the script silently adds a dev-buy extension and sends ETH as part of the deployment transaction, introducing an on-chain purchase side effect beyond straightforward token deployment. In a skill that asks users for a private key and signs live transactions, this hidden extra spend increases the chance of unintended fund usage and misleading operator expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script signs and broadcasts a live blockchain transaction immediately after building it, with no interactive confirmation, dry-run mode, or final summary requiring user approval. Because the skill explicitly requires a private key and may send ETH value, a mistaken invocation, wrong RPC, malformed parameters, or misleading wrapper automation can directly cause irreversible on-chain loss.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The header comment says the script 'Tests read-only operations on Base mainnet', which implies no local state changes. However, when the config does not exist, the script creates directories and writes a new config.json file in ~/.clawdbot/skills/clanker, so the documentation contradicts the actual side effects.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The description explains what the skill does but does not define specific trigger phrases, invocation constraints, or when it should not activate. In a markdown skill file, this can lead to overly broad or unintended invocation because the activation boundary is left implicit.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/deploy.py (reported line 488)May include surrounding context.

python

print(f"Warning: Could not verify hook/locker/mev module enablement: {exc}")

    # Get the correct function based on deploy method
    deploy_func = getattr(clanker_contract.functions, deploy_method)

    # Build transaction
    nonce = w3.eth.get_transaction_count(account.address)

Static analysis

No suspicious patterns detected.