Zapper

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:26 AM UTC
• Version: 1.0.0

Overview

The skill appears to do what it claims, but it handles wallet activity and an API key with under-disclosed privacy and credential-safety risks.

Review before installing. Use this only if you are comfortable sending queried wallet addresses and related DeFi, NFT, and transaction data to Zapper. Store the API key with restrictive permissions, avoid shared machines, and avoid passing untrusted address or symbol strings until the JSON construction and config-path handling are fixed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/zapper.sh:20

Finding

Python Code Injection Through an Attacker-Controlled Configuration Path

Content

View full analysis

/dev/null || echo "") ``` ### Technical Analysis `CONFIG_FILE` is derived from the `HOME` environment variable and interpolated directly into the source code supplied to `python3 -c`. Shell quoting protects the value from direct shell expansion, but it does not make the resulting text safe as a Python string literal. If `HOME` contains a single quote followed by valid Python syntax, the generated path can terminate the argument to `open()` and introduce additional Python statements. The attacker must also arrange for the shell's `[[ -f "$CONFIG_FILE" ]]` check to succeed, but this is possible when the attacker controls the relevant filesystem hierarchy. The vulnerable function is reached by the `portfolio`, `tokens`, `apps`, `nfts`, `tx`, and `claimables` commands. ### Attack Path 1. An attacker gains control over the `HOME` environment variable supplied to the script, such as through an unsafe service wrapper, automation job, or delegated execution environment. 2. The attacker assigns a path containing a single quote and injected Python syntax to `HOME`. 3. The attacker creates the corresponding filesystem path and `config.json` entry so that the `-f` check succeeds. 4. A command that invokes `load_api_key` is executed. 5. The crafted path is embedded into the `python3 -c` source string. 6. Python parses and executes the injected statements with the privileges of the user running the skill. ### Impact Assessment Successful exploitation permits arbitrary local code execution with the operating-sy ...[truncated 351 chars]

Remediation

View remediation

/dev/null`. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/zapper.sh:67

Finding

GraphQL Request Manipulation Through Unsafe JSON Construction

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:18

Finding

API Key Configuration May Be Created with Overly Broad File Permissions

Content

View full analysis

~/.clawdbot/skills/zapper/config.json << 'EOF' { "apiKey": "YOUR_ZAPPER_API_KEY" } EOF ``` `references/api.md` repeats the same procedure: ```bash mkdir -p ~/.clawdbot/skills/zapper cat > ~/.clawdbot/skills/zapper/config.json << 'EOF' { "apiKey": "YOUR_ZAPPER_API_KEY" } EOF ``` ### Technical Analysis The documented setup creates a plaintext file containing an API key but does not set a restrictive `umask` or explicitly apply file permissions. The final permissions therefore depend on the user's environment. With a commonly used `umask` of `022`, the directory may be created as mode `755` and the configuration file as mode `644`. On a multi-user system, that can make the API key readable by other local accounts. The issue concerns local access control. The project does not hardcode a real credential, and the reviewed script only sends the loaded key to the documented Zapper endpoint. ### Attack Path 1. A user follows the documented configuration procedure on a shared system. 2. The user's active `umask` permits group or world read access. 3. `config.json` is created with permissions such as `0644`. 4. Another local user traverses the configuration directory and reads the file. 5. The local user obtains the Zapper API key and uses it independently. ### Impact Assessment A local attacker may obtain the Zapper API credential, consume its request quota, and access API functionality authorized for that key. The precise data and operations exposed depend on the Zapper account and key permissions. This finding does not grant operating-system privilege escalation. Exploitation requires local filesystem access under an account permitted to read t ...[truncated 27 chars]

Remediation

View remediation

~/.clawdbot/skills/zapper/config.json << 'EOF' { "apiKey": "YOUR_ZAPPER_API_KEY" } EOF chmod 600 ~/.clawdbot/skills/zapper/config.json ``` The script should also verify permissions before reading the credential and warn or fail when the file is accessible by group or other users. Where supported by the host platform, prefer a dedicated secret manager or protected environment-based credential injection over a plaintext configuration file. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill advertises and demonstrates shell-based usage but does not declare any explicit tool scope such as permissions or allowed-tools. This increases the chance that an agent can invoke shell access more broadly than intended, reducing least-privilege controls and making misuse or chaining with other prompts more dangerous.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill sends wallet addresses and associated portfolio, NFT, and transaction data to Zapper's third-party API, but the description does not warn users about this external data disclosure. Even though wallet data is often public on-chain, correlating and transmitting it to a third party can create privacy and tracking risks that users may not expect.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

Get your API key from Zapper Dashboard (free tier available):

bash

mkdir -p ~/.clawdbot/skills/zapper
cat > ~/.clawdbot/skills/zapper/config.json << 'EOF'
{
  "apiKey": "YOUR_ZAPPER_API_KEY"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documentation instructs users to send wallet addresses and retrieve portfolio and transaction history from Zapper's third-party API, but it does not warn that this exposes potentially sensitive financial metadata to an external service. Even though blockchain data is public, linking queried addresses to a user's session, IP, and API account can create privacy and profiling risks that users may not expect.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The example directs users to store a long-lived API key in a persistent plaintext config file under the home directory. While common in developer tooling, persistent secret storage increases exposure if the host is shared, backups are accessible, or file permissions are weak, and the documentation does not mention hardening steps.

Content

Scanner excerpt · references/api.md (reported line 11)May include surrounding context.

bash

# Set your API key in config
mkdir -p ~/.clawdbot/skills/zapper
cat > ~/.clawdbot/skills/zapper/config.json << 'EOF'
{
  "apiKey": "YOUR_ZAPPER_API_KEY"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The script uses curl to POST user-supplied wallet addresses and query parameters to an external GraphQL endpoint. This external transmission is intentional and core to the feature, but it still creates a genuine confidentiality/privacy risk because sensitive financial metadata about a user's wallets and holdings leaves the local environment and is exposed to a third-party service.

Content

Scanner excerpt · scripts/zapper.sh (reported line 40)May include surrounding context.

sh

}

_post() {
  curl -s "$API" -X POST \
    -H "Content-Type: application/json" \
    -H "x-zapper-api-key: $API_KEY" \
    -d "$1"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This skill sends wallet addresses and related portfolio/transaction queries to Zapper's external API, which is a real privacy-relevant data flow. Even though this is necessary for the skill's functionality and does not appear malicious, users are not explicitly warned that their on-chain identifiers and activity data will be disclosed to a third party, which can enable profiling or linkage of wallets to users.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.