SUPAH Base Intelligence

• Outcome: Review
• Latest audit: Sep 14, 2026 · 11:00 PM UTC
• Version: 1.3.0

Overview

This crypto intelligence skill is mostly coherent, but it uses paid automatic API calls and wallet/token lookups with unclear payment controls, inconsistent pricing, and an unrestricted API-host override.

Review this skill before installing. It appears to be a read-only API client, but use it only with explicit user approval for paid calls, set spending limits in the x402 client, avoid automated trading based only on its signals, and do not set SUPAH_API_BASE unless you trust the destination that will receive token and wallet identifiers.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T09 · Insecure Skill Coding Practices

Warning

• Location: index.js:11

Finding

Unrestricted API Host Override Enables Arbitrary Outbound HTTPS Requests

Content

View full analysis

{ const options = { hostname: API_BASE, port: 443, path: path, method: 'GET', headers: { 'User-Agent': 'OpenClaw-SUPAH-Skill/1.2.0' } }; https.get(options, (res) => { ``` ### Technical Analysis The `SUPAH_API_BASE` environment variable is passed directly to the `hostname` property of `https.get()` without validation or an allowlist. Although `SKILL.md:10` declares outbound access only to `api.supah.ai`, the implementation can connect to any HTTPS host supplied through the environment. This creates a limited server-side request forgery condition when an attacker can influence the process environment or skill configuration. The attacker can redirect token addresses, wallet addresses, and other requests to an attacker-controlled service or an HTTPS-accessible internal service. The returned JSON is also accepted as legitimate intelligence data, allowing the substituted endpoint to forge token safety scores, trading signals, or portfolio results. ### Attack Path 1. An attacker gains control over the environment or configuration used to launch the skill. 2. The attacker sets `SUPAH_API_BASE` to an attacker-controlled hostname or an internal HTTPS service. 3. A user invokes a token, wallet, safety, signal, or whale-analysis operation. 4. The skill sends the request and associated token or wallet identifier to the substituted host. 5. The attacker records the identifiers or returns fabricated JSON. 6. The skill presents the attacker-controlled response as a successful intelligence result. ### Impact Assessment The issue does not directly grant local ...[truncated 425 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: index.js:48

Finding

Unvalidated Identifiers Permit Outbound Request Path Manipulation

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: index.js:25

Finding

HTTP Client Lacks Status Validation, Response Limits, and Timeouts

Content

View full analysis

{ let data = ''; res.on('data', chunk => data += chunk); res.on('end', () => { try { resolve(JSON.parse(data)); } catch (e) { reject(new Error('Invalid JSON response')); } }); }).on('error', reject); ``` ### Technical Analysis The HTTP client accumulates the entire response in memory without enforcing a maximum size. It also does not configure a connection or response timeout and does not inspect `res.statusCode`. A malicious, compromised, or malfunctioning server can therefore send an indefinitely slow response or an oversized body. In addition, JSON error responses with non-success HTTP status codes are resolved as successful data because syntactically valid JSON is the only success criterion. This risk becomes more significant when combined with the unrestricted `SUPAH_API_BASE` override because an attacker-controlled endpoint can deliberately exercise these missing controls. ### Attack Path 1. The skill requests data from the configured API endpoint. 2. The endpoint delays completion, continuously streams data, or returns a non-success response containing valid JSON. 3. The skill does not terminate the request based on elapsed time or response size. 4. Memory consumption or execution time increases until the process or an external supervisor terminates the operation. 5. Alternatively, a JSON error document is accepted as a successful intelligence result. ### Impact Assessment No elevated privileges are obtained. The affected scope includes: - Denial of service against the Node.js skill process. - Excessive memory consumption from unbounded response buffering. - Indefinitely stalled calls. - Misclassification of HTTP errors as successful intelligence responses. - Reduced reliabi ...[truncated 88 chars]

Remediation

View remediation

other

Note

• Location: SKILL.md:9

Finding

Conflicting Payment Limits and Advertised Endpoint Prices

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The declared description understates or omits material behaviors, including wallet/portfolio analysis, discovery features, and market-regime retrieval, while presenting the skill as a focused token-intelligence engine. This mismatch can mislead users and calling agents about what data will be sent externally and what actions or paid API calls may occur, which is especially risky in a crypto context involving wallet addresses and micropayments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README encourages users to run portfolio and whale analysis on wallet addresses but does not clearly disclose that those addresses are transmitted to SUPAH-controlled external API endpoints. Wallet addresses are sensitive financial metadata because they reveal holdings, behavior, and trading relationships; sending them off-platform without explicit warning can create privacy, profiling, and surveillance risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README mentions x402 micropayments and pricing, but it does not provide a clear, high-visibility warning that invoking commands causes automatic on-chain USDC payments. In an agent setting, this can lead to unintended financial loss because repeated or automated calls may spend funds without the operator realizing each request is billable and settled on-chain.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 91% confidence

Finding

The README provides an example of automatically executing trades based on SUPAH signals and security scores, which normalizes autonomous financial decision-making without human approval or additional safeguards. In this skill's context, that is especially dangerous because the tool supplies external market intelligence and paid signals, so blind automation can amplify bad data, model error, API compromise, or market manipulation into real financial losses.

Content

Scanner excerpt · README.md (reported line 211)May include surrounding context.

Automated Trading Bot

javascript

// Get signals and auto-execute
const signals = await supah.getSignals({ minScore: 85 });

for (const signal of signals) {

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill declares environment and binary requirements but does not define an explicit tool scope such as permissions or allowed-tools. That creates ambiguity about what execution capabilities the agent may use, increasing the chance of over-broad tool access or unintended command/network behavior when the skill is invoked.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill advertises wallet analysis but does not clearly warn that wallet-related data is transmitted to an external paid API. This creates a privacy and consent issue: users or upstream agents may submit sensitive wallet identifiers without understanding the third-party disclosure and possible billing implications.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This is a manifest file, so vague-trigger checks apply. The description and tags advertise wide-ranging functions like portfolio analysis, signals, and whale tracking, but do not specify how or when the skill should be invoked, nor provide exclusions or negative examples to bound trigger scope.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The usage section says to ask the agent 'natural questions like' and then gives examples such as 'Check if this token is safe' and 'Show me whale moves,' but it does not define a specific trigger set or when the skill should not activate. This ambiguity can cause unintended invocation because the phrasing overlaps with normal conversational requests about crypto tokens.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The features array enumerates multiple possible tasks, from security scanning to predictions and alerts, but gives no specificity about what user requests should activate the skill versus ordinary discussion about trading. In a manifest, this can contribute to unintended invocation if downstream systems rely on these descriptions for matching.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

At L17, the script calls supah.scanToken(address), which by its purpose likely performs a remote scan or API request, but the file provides no explicit disclosure that the supplied token address will be sent to an external service. While the script does print that a scan is occurring, it does not warn about network access or data sharing behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.