ClawHub
Back to skill

Security audit

8004 Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed blockchain helper for registering and managing agent identities, but users should treat its wallet-key handling and mainnet transactions as sensitive.

Install only if you are comfortable giving the skill access to a wallet private key for TRON/BSC transactions. Use a testnet or low-value dedicated wallet, avoid persistent plaintext key storage when possible, verify the selected network and contract addresses, and review every mainnet transaction before signing or running write commands.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
Findings (26)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · README.md (reported line 213)May include surrounding context.

vate Key Configuration

ERC-8004 supports multiple methods for private key configuration:

Priority Order:

  1. TRON_PRIVATE_KEY environment variable
  2. PRIVATE_KEY environment variable
  3. ~/.clawdbot/wallets/.deployer_pk file

Setup Examples:

bash
# Method 1: Environment variable (temporary)
export TRON_PRIVATE_KEY="your_private_key"

# Method 2: Environment variable (persistent)
echo 'export TRON_PRIVATE_KEY="your_key"' >> ~/.bashrc
source ~/.bashrc

# Method 3: File storage (shared with ERC-8004)
mkdir -p ~/.clawdbot/wallets
echo "your_private_key" > ~/.clawdbot/wallets/.deployer_pk
chmod 600 ~/.clawdbot/wallets/.deployer_pk

Resources

Official

TRON Resources

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared description frames the skill as identity registration/management, but the content includes transaction-signing workflows, private key handling, URI updates, and submission of on-chain feedback. This mismatch can mislead users or orchestrators into invoking a financial/write-capable skill without realizing it can perform state-changing blockchain actions.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared description frames the skill as identity registration/management, but the content includes transaction-signing workflows, private key handling, URI updates, and submission of on-chain feedback. This mismatch can mislead users or orchestrators into invoking a financial/write-capable skill without realizing it can perform state-changing blockchain actions.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.

md
node scripts/query.js agent 1 --chain tron --network nile

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

md
node scripts/query.js agent 1 --chain tron --network nile

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 200)May include surrounding context.

md
node scripts/query.js agent 1 --chain tron --network nile

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · CHANGELOG.md (reported line 41)May include surrounding context.

md
- Added complete IdentityRegistry ABI
  - Added complete ReputationRegistry ABI with all functions
  - Added complete ValidationRegistry ABI
- **TRON ABIs**: Split into query/write subsets to avoid TronWeb tuple[] parsing issues

### Fixed
- **CRITICAL: package.json scripts**: Fixed npm run commands to use correct script names

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

This markdown file documents support for loading private keys from environment variables and a filesystem path, which is a privacy- and security-relevant behavior. The section presents the mechanism as a feature but does not include any warning about protecting credentials, avoiding committing key files, or the risks of storing signing keys on disk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README instructs users to place a blockchain private key into an environment variable or a plaintext file without any explicit warning that this credential grants control over on-chain assets and identities. In a blockchain skill, mishandling a private key can directly lead to account takeover, unauthorized transactions, and irreversible loss.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

The README recommends persisting a private key in ~/.clawdbot/wallets/.deployer_pk, creating a durable credential store on disk. Even with chmod 600, local compromise, backups, shell history, malware, or accidental inclusion in support bundles can expose the key and allow unauthorized blockchain actions.

Content

Scanner excerpt · README.md (reported line 95)May include surrounding context.

export TRON_PRIVATE_KEY="your_64_character_hex_private_key"

Method 2: File storage

mkdir -p ~/.clawdbot/wallets echo "your_private_key" > ~/.clawdbot/wallets/.deployer_pk chmod 600 ~/.clawdbot/wallets/.deployer_pk

text

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 97)May include surrounding context.

Method 2: File storage

mkdir -p ~/.clawdbot/wallets echo "your_private_key" > ~/.clawdbot/wallets/.deployer_pk chmod 600 ~/.clawdbot/wallets/.deployer_pk

text

### Register an Agent

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 219)May include surrounding context.

Method 2: File storage

mkdir -p ~/.clawdbot/wallets echo "your_private_key" > ~/.clawdbot/wallets/.deployer_pk chmod 600 ~/.clawdbot/wallets/.deployer_pk

text

### Register an Agent

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 216)May include surrounding context.

Method 2: File storage

mkdir -p ~/.clawdbot/wallets echo "your_private_key" > ~/.clawdbot/wallets/.deployer_pk chmod 600 ~/.clawdbot/wallets/.deployer_pk

text

### Register an Agent

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README provides ready-to-run mainnet registration, feedback, and update commands without warning that these actions create irreversible on-chain transactions and may incur fees or modify public identity state. Users may execute production commands unintentionally, causing unwanted registrations, metadata changes, or financial cost.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
91% confidence
Finding

This section again directs users to persist a private key in a fixed path under the home directory, which increases the exposure window for a credential that controls blockchain identity and transactions. In the context of this skill, the stored key is especially sensitive because misuse can trigger irreversible on-chain operations.

Content

Scanner excerpt · README.md (reported line 217)May include surrounding context.

source ~/.bashrc

Method 3: File storage (shared with ERC-8004)

mkdir -p ~/.clawdbot/wallets echo "your_private_key" > ~/.clawdbot/wallets/.deployer_pk chmod 600 ~/.clawdbot/wallets/.deployer_pk

text

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill documents shell commands and use of environment variables/private-key material, but it does not declare any explicit tool scope such as permissions or allowed-tools. In an agent setting, this creates ambiguity around what execution capabilities are intended, increasing the chance that a host agent may expose shell or env access more broadly than necessary.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
83% confidence
Finding

The phrase encouraging users to run any script, combined with documented write-capable scripts like register, feedback, and set-uri, normalizes broad execution without clear guardrails. In an agent context, unrestricted invocation of scripts that can sign transactions or consume secrets increases the risk of unintended blockchain writes or misuse of wallet credentials.

Content

Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.

md
- **feedback.js** - Submit feedback/reputation scores
- **set-uri.js** - Update agent metadata URI

Run any script without arguments to see detailed usage information.

## Examples

Session Persistence

Medium
Category
Rogue Agent
Confidence
91% confidence
Finding

The skill advises storing a blockchain private key persistently under ~/.clawdbot/wallets/.deployer_pk. Persisting signing keys on disk inside an agent-associated directory materially increases the risk of credential theft, reuse across sessions, and unintended autonomous transactions if the host environment or other skills can access that path.

Content

Scanner excerpt · SKILL.md (reported line 214)May include surrounding context.

export TRON_PRIVATE_KEY="your_64_character_hex_private_key"

Option 2: File storage

mkdir -p ~/.clawdbot/wallets echo "your_private_key" > ~/.clawdbot/wallets/.deployer_pk chmod 600 ~/.clawdbot/wallets/.deployer_pk

text

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script parses --metadata arguments into options.metadata, and the usage text later advertises metadata support, but the actual registration transaction only calls register with an optional URI and never passes metadata to the contract. This is an intent/documentation mismatch because the inline usage and option documentation imply a capability the code does not implement.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This utility function actively reads a blockchain private key from environment variables or a persistent local file, which is a real credential-access capability. In the context of an agent skill, that is security-sensitive because any downstream script using this helper can silently obtain signing authority for on-chain actions, and the module provides no scope limitation, consent prompt, or provenance check around that access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The code reads sensitive private-key material successfully without any user-facing disclosure, audit log, or confirmation. In an agent/automation setting this increases the chance that users do not realize a skill is accessing signing credentials, making misuse or unexpected blockchain transactions harder to detect before damage occurs.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/utils.js (reported line 62)May include surrounding context.

js
console.error('   export PRIVATE_KEY="your_private_key_here"');
    console.error('');
    console.error('2. File storage:');
    console.error('   mkdir -p ~/.clawdbot/wallets');
    console.error('   echo "your_private_key_here" > ~/.clawdbot/wallets/.deployer_pk');
    console.error('   chmod 600 ~/.clawdbot/wallets/.deployer_pk');
    console.error('');

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/utils.js (reported line 64)May include surrounding context.

js
console.error('2. File storage:');
    console.error('   mkdir -p ~/.clawdbot/wallets');
    console.error('   echo "your_private_key_here" > ~/.clawdbot/wallets/.deployer_pk');
    console.error('   chmod 600 ~/.clawdbot/wallets/.deployer_pk');
    console.error('');
    process.exit(1);
  }

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The dependency uses a caret range (^6.0.0), which permits automatic installation of newer minor and patch releases. That creates supply-chain risk because a compromised or breaking upstream release could be pulled in without explicit review, which is especially relevant for blockchain tooling that may handle keys, transactions, or on-chain identity operations.

Content

Scanner excerpt · package.json (reported line 28)May include surrounding context.

json
"author": "TRON Skills",
  "license": "CC0-1.0",
  "dependencies": {
    "tronweb": "^6.0.0",
    "ethers": "^6.13.0"
  },
  "engines": {

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The dependency uses a caret range (^6.13.0), allowing npm to resolve to newer minor and patch versions over time. In a skill that interacts with BSC and likely signs or submits blockchain transactions, this increases supply-chain exposure because an upstream malicious or vulnerable release could alter runtime behavior without a source change in this repository.

Content

Scanner excerpt · package.json (reported line 29)May include surrounding context.

json
"license": "CC0-1.0",
  "dependencies": {
    "tronweb": "^6.0.0",
    "ethers": "^6.13.0"
  },
  "engines": {
    "node": ">=16.0.0"

Static analysis

No suspicious patterns detected.