Crypto Price Prediction

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:18 AM UTC
• Version: 1.0.1

Overview

The skill is a narrow crypto price prediction wrapper with disclosed external API use and limited local timezone storage, with documentation gaps but no evidence of malicious behavior.

Reasonable to install if you are comfortable sending BTC/ETH lookup requests to the listed prediction service and CoinGecko. Be aware it stores a timezone preference under your home config directory, and the OpenClaw manifest should be updated to match the fuller SKILL.md documentation.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared behavior understates what the skill actually does: it contacts an additional third-party service, persists local configuration, prompts interactively, and derives extra output fields. This kind of description-behavior mismatch is dangerous because users and orchestration systems may authorize or trust the skill under false assumptions, leading to unintended data disclosure, policy bypass, or execution in contexts where local writes and extra network calls are not acceptable.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill advertises itself as self-contained but does not declare any explicit tool scope despite requiring network access and local file read/write for timezone persistence. In an agent environment, missing permission boundaries can lead to overbroad execution privileges, reduce user visibility into what the skill can access, and make misuse or unexpected behavior harder to contain.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The markdown omits a clear privacy and data-handling warning even though the skill sends request data to external third-party APIs and stores timezone information locally. Without prominent disclosure, users may unknowingly expose usage metadata or allow persistent local state, which is especially relevant in agent ecosystems where skills may be invoked indirectly.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/predict.py (reported line 12)May include surrounding context.

python

from datetime import datetime, timezone, timedelta

API_BASE = "https://myfastapi.zeabur.app/v1/demo/predictions/next_hour"
COINGECKO_API = "https://api.coingecko.com/api/v3/simple/price"
VALID_COINS = ["BTC", "ETH"]
COINGECKO_IDS = {"BTC": "bitcoin", "ETH": "ethereum"}

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest presents the skill as a price-prediction fetcher for two symbols, but the implementation stores user configuration under ~/.config and may prompt on first run. Local stateful configuration is a meaningful behavior beyond a simple fetch operation and is not an obvious requirement of the stated purpose.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

A crypto price prediction fetcher would obviously need network access to query prediction data, but writing configuration files to the user's home directory is a separate capability. Persisting timezone preferences is a convenience feature that is not declared in the stated purpose and is not necessary to fetch next-hour predicted prices.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest describes a narrow function: fetching next-hour predicted price for BTC/ETH from an external prediction API. In addition to that, the code calls CoinGecko for current prices and uses that data to compute and return a predictedDirection field, expanding the behavior beyond the stated description.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The implementation does not match the declared behavior: instead of directly fetching from an external prediction API, it delegates to a local Python script. This mismatch is dangerous because it obscures actual capabilities from reviewers and users, making it easier to hide unauthorized local execution, data access, or additional network activity behind a benign-seeming API wrapper.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill spawns a local Python subprocess even though its stated purpose is only to fetch a prediction from an external API. Introducing an interpreter subprocess expands the attack surface substantially: the Python runtime, local script behavior, and environment become part of the trust boundary, and this enables hidden local side effects or execution paths not implied by the manifest.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The output schema specifies the timestamp as being "in HKT," which imposes a specific locale/timezone convention in natural language. Under the policy, locale constraints should either be user-selectable or clearly documented as justified; this manifest provides neither.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The manifest specifically says the skill fetches predicted price from an external prediction API, which suggests a single API aligned with that purpose. The code also accesses CoinGecko as an additional external dependency, which is not reflected in the manifest and changes the operational behavior users would expect.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: skill.js:47