ClawHub
Back to skill

Security audit

Crypto Whale Alerts

Security checks for vulnerabilities and agentic risk

Overview

This skill is a local mock crypto-alert helper, but its marketing overstates the accuracy and live-data capabilities users might expect.

Install only if you understand this is a mock/demo-style local script, not a reliable live trading signal. Do not rely on its alerts for financial decisions without independent verification from real blockchain data and market sources.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
The skill documentation materially overstates capabilities and behavior, which can cause an agent or user to rely on outputs as if they were real-time, multi-chain, and semantically accurate when they are not. In a trading context, this can mislead downstream decisions, create false confidence in market signals, and mask the fact that threshold changes and pattern detection may not actually work as described.

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding
The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Intent-Code Divergence

High
Confidence
99% confidence
Finding
The alert direction is derived from whether the sender is known, not from the manifest's stated classification of exchange receiving = INFLOW and cold-storage accumulation = OUTFLOW. In a trading/agent context, this can invert market signals and cause automated or human users to act on materially false alerts, creating integrity risk and potentially financial harm.

Missing User Warnings

Medium
Confidence
85% confidence
Finding
The skill produces actionable whale alerts that could influence financial trades, but it omits a warning that the output is not financial advice and may be incomplete, delayed, or inaccurate. In this context, the absence of clear risk disclosure increases the chance that users or agents will treat speculative signals as authoritative trading guidance.

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The manifest defines INFLOW as exchange receiving and OUTFLOW as cold-storage accumulation, but this function treats "inflow" transactions as buys and labels a high inflow ratio as "accumulation". That directly reverses the stated semantic meaning and makes the documented intent inconsistent with the implemented analysis logic.

Description-Behavior Mismatch

Medium
Confidence
98% confidence
Finding
The manifest exposes a command named "set-threshold <usd>" and describes configurable alert thresholds, implying the command changes future scan behavior. In practice, this branch only prints a confirmation message and does not update environment state, a config file, or even the in-memory threshold used by subsequent commands.

Static analysis

No suspicious patterns detected.