ClawHub
Back to skill

Security audit

stacktree

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed publishing helper for stacktr.ee with sensitive wallet/API-key flows that match its stated purpose and are not hidden.

Install this only if you want an agent to publish or update pages on stacktr.ee. Treat the wallet private key and any stk_live_ API key as real credentials: keep them out of chat transcripts and logs, use the default stacktr.ee endpoint unless you intentionally trust another one, and confirm the site ID before updating an existing public or client-facing link.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

External Transmission

Medium
Category
Data Exfiltration
Content
revise a page is the one mistake every agent makes here. Don't. The flow is
three steps, signs one message, moves no funds:

1. `POST https://api.stacktr.ee/wallet-auth/challenge` with `{"wallet":"0x…"}`
   (the wallet that paid). Response: `{ challenge, message, expires_at }`.
2. `personal_sign` (EIP-191) the exact `message` text with that wallet.
3. `PUT https://api.stacktr.ee/sites/{id}` — multipart, field `file` = the new
Confidence
95% confidence
Finding
The skill instructs sending a wallet address to a remote challenge endpoint as part of an authentication flow tied to a funded wallet. In context, this is not inherently malicious, but it materially increases risk because it initiates a signing workflow around a funded identity and could expose wallet-linked metadata or enable unauthorized content updates if the surrounding process is mishandled.

External Transmission

Medium
Category
Data Exfiltration
Content
1. `POST https://api.stacktr.ee/wallet-auth/challenge` with `{"wallet":"0x…"}`
   (the wallet that paid). Response: `{ challenge, message, expires_at }`.
2. `personal_sign` (EIP-191) the exact `message` text with that wallet.
3. `PUT https://api.stacktr.ee/sites/{id}` — multipart, field `file` = the new
   HTML — with header `Authorization: Wallet challenge=WAUTH-…,sig=0x…`.

Same URL, new content, $0. Challenges are single-use with a 5-minute TTL: one
Confidence
97% confidence
Finding
This line documents transmitting a signed wallet-based authorization header to update hosted content. Even though the skill explicitly warns not to expose the private key, the existence of a reusable authenticated update flow means any leakage of challenge/signature material, site identifiers, or signing access could let an attacker silently replace content at an already-shared URL.

External Transmission

Medium
Category
Data Exfiltration
Content
## Buying an API key ($1.00) — when it's actually right

`POST https://api.stacktr.ee/provision`, pay the 402 for $1.00, and the
response returns a persistent `stk_live_` key **once** — store it immediately,
then send it as `Authorization: Bearer` on `POST /sites` / `PUT /sites/{id}`.
Confidence
96% confidence
Finding
The skill instructs obtaining and then storing a persistent bearer API key that can later authorize site creation and updates. A long-lived token returned once and reused for privileged operations is a meaningful secret-handling risk: if it is exposed in agent logs, prompts, or insecure storage, an attacker could create or modify pages without further payment or user awareness.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"private": true,
  "type": "module",
  "dependencies": {
    "viem": "^2.21.0"
  }
}
Confidence
93% confidence
Finding
The dependency uses a caret range (^2.21.0), which permits installation of newer minor and patch releases rather than a single audited version. This can introduce supply-chain risk or non-reproducible builds if an upstream release is compromised or contains breaking security-relevant changes, though the impact here is limited because this file only declares one dependency and does not itself execute privileged logic.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/update-page.mjs:43