ClawHub
Back to skill

Security audit

crypto-token-analyzer

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly purpose-aligned, but it should be reviewed because it tells the agent to run shell curl commands using user-supplied token values without strict validation.

Install only if you are comfortable with the agent contacting third-party crypto data APIs for queried token addresses, and avoid giving malformed or untrusted address strings. A safer version should validate addresses and chain IDs strictly and use a structured HTTP client instead of shell curl.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:21
Finding

Command Injection Through Unvalidated Contract Address Interpolation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Anti-Refusal Statement

High
Category
Anti-Refusal
Confidence
70% confidence
Finding

Skill instructs the agent to never refuse or to always comply. Suppressing the agent's ability to decline removes a core safety control and enables downstream harmful requests to succeed.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md
# Crypto Token Analyzer

Analyze any token given its contract address and chain. Combine live market data, on-chain signals, and security checks, then give a clear subjective judgment and actionable strategy advice. Always respond in the language of the current conversation.

## Supported Chains (default)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger description is overly broad because it activates on vague phrases like 'similar crypto token queries,' which can cause the skill to engage outside its narrowly intended scope. In a financial-analysis skill, over-triggering is risky because it may provide investment-style guidance in contexts where the user did not explicitly request this tool or where another safer workflow should handle the request.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This skill instructs the agent to send user-supplied token addresses to an external third-party API via curl. External transmission can expose sensitive user-supplied inputs, create privacy/logging risks, and allow uncontrolled network access patterns; in an agent setting, direct shell-based HTTP calls also increase the chance of unsafe command construction if interpolation is not tightly controlled.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

  • Prefer API calls via bash + curl for speed and reliability.

    bash
    curl 'https://api.dexscreener.com/latest/dex/tokens/{tokenAddress}'
curl 'https://api.dexscreener.com/latest/dex/pairs/v1/{chainId}/{tokenAddress}'

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

A second external API path is defined for pair lookup using user-influenced chain and address inputs. While expected for the skill's purpose, it still constitutes outbound transmission to a third party and may amplify risk if the agent automatically fetches data for arbitrary addresses or constructs requests unsafely.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

bash
   curl 'https://api.dexscreener.com/latest/dex/tokens/{tokenAddress}'
   curl 'https://api.dexscreener.com/latest/dex/pairs/v1/{chainId}/{tokenAddress}'
  • priceUsd, priceChange (m5/h1/h6/h24), volume, liquidity, fdv, marketCap, pairCreatedAt, txs (buys/sells), labels, info (socials, websites), boost.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The GoPlus security check sends the queried contract address to another external service, creating the same privacy and outbound-communication concerns as the DexScreener calls. Because this skill is designed to fetch live token risk data, the behavior is contextually expected, but it still expands the attack surface and may expose user interest patterns or permit unsafe request building if implemented via shell interpolation.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

  • GoPlus (free public endpoint, no key required for basic):

    bash
    curl 'https://api.gopluslabs.io/api/v1/token_security/{goplusChain_id}?contract_addresses={address}'
    • ethereum=1, bsc=56, polygon=137, arbitrum=42161, avalanche=43114, base=8453.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/data-sources.md (reported line 11)May include surrounding context.

GET /latest/dex/tokens/{tokenAddress}

text
```bash
curl -s "https://api.dexscreener.com/latest/dex/tokens/0x..."
text

Static analysis

No suspicious patterns detected.