ClawHub
Back to skill

Security audit

Crypto Holdings Monitor

Security checks for vulnerabilities and agentic risk

Overview

This crypto portfolio skill is not clearly malicious, but it overstates its financial monitoring abilities and stores wallet addresses locally without enough disclosure.

Install only if you are comfortable with a simple prototype that stores wallet addresses in a home-directory JSON file and contacts CoinGecko for market prices. Do not rely on it for actual wallet balances, portfolio holdings, profit/loss, alerts, or financial decisions unless the implementation is corrected and the storage/network behavior is documented.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
The documented behavior overstates what the skill actually does, claiming wallet monitoring, holdings analysis, and reporting without evidence of genuine balance retrieval or portfolio computation. In a financial context, this can mislead users into trusting incomplete or fabricated portfolio views, causing bad decisions or disclosure of wallet addresses under false assumptions about the tool’s accuracy.

Lp3

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding
The skill advertises code-driven behavior that implies file access and network use, but it does not declare any tool scope such as permissions or allowed-tools. This creates a governance and containment gap: an agent platform may grant broader capabilities than users expect, increasing the risk of unintended file access, local state modification, or outbound requests when the skill runs.

Natural-Language Policy Violations

Medium
Confidence
88% confidence
Finding
The manifest description and usage documentation are presented entirely in Chinese while the skill title and one trigger use English, but there is no statement offering users a language choice or documenting a justified locale restriction. This can violate language/locale policy when users are not explicitly opted into Chinese output or interaction.

Vague Triggers

Medium
Confidence
94% confidence
Finding
Overly broad trigger phrases can cause the skill to activate in unrelated conversations, especially with generic terms like 'Crypto' or short colloquial phrases. Unintended activation matters here because the skill appears to use file and network capabilities, which could expose wallet-related data or perform actions when the user did not intend to invoke this skill.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The file presents its title and user-facing messages in Chinese, and no opt-in or alternative language support is offered. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless the locale restriction is clearly documented and justified.

External Transmission

Medium
Category
Data Exfiltration
Content
DATA_FILE = os.path.expanduser("~/.crypto-portfolio.json")

# 简化版 CoinGecko API（免费，无需 Key）
PRICE_API = "https://api.coingecko.com/api/v3/simple/price"

def load_data():
    if os.path.exists(DATA_FILE):
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
Wallet addresses are persisted to a predictable file in the user's home directory without any notice, consent flow, or permission hardening. While wallet addresses are not secret keys, they are sensitive financial metadata and can reveal asset ownership patterns if the local system is shared or compromised.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill performs HTTP requests to api.coingecko.com to retrieve prices, which is a network operation covered by the warning requirement for code files. While the API is commented as free and keyless, there is no explicit user-facing notice in CLI help, docstrings, or comments that using view/refresh/report contacts an external service.

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The manifest describes a crypto holdings monitor that supports multi-wallet monitoring, real-time price queries, and holdings statistics. In practice, the code merely adds wallet addresses to a local JSON file and prints a fixed set of token prices and wallet counts; it never fetches wallet balances, computes per-wallet holdings, or produces actual portfolio statistics.

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The command help and user-facing output indicate that it will display holdings, which implies wallet-derived asset balances or positions. However, the implementation does not inspect any wallet contents and instead only fetches generic prices for a hardcoded list of coins and echoes stored wallet addresses.

Overly Broad Trigger

Low
Category
Trigger Abuse
Confidence
70% confidence
Finding
Overly Broad Trigger: '炒币' is too short and may match unintended inputs

Static analysis

No suspicious patterns detected.