ClawHub
Back to skill

Security audit

Orderly Sdk React Hooks

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent SDK reference, but it includes copy-pastable live trading and fund-movement examples without enough safety scoping or warnings.

Review before installing or using this skill to generate production code. Treat the financial-operation snippets as illustrative only, add explicit user confirmations, validate symbols, prices, amounts, token addresses, chain IDs, and destination addresses, prefer testnet first, and avoid automatic approvals, cancel-all actions, withdrawals, or leverage changes without clear user review.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

High
Confidence
97% confidence
Finding
The deposit and withdrawal examples invoke approve, deposit, and withdraw flows with realistic parameters but omit any warning that these operations move assets and may be irreversible or costly if addresses, chain IDs, token metadata, or amounts are wrong. Because this is wallet-connected financial code, copy-pasting these examples can directly lead to asset loss, mistaken approvals, or withdrawals to incorrect destinations.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The trading examples demonstrate live order placement, cancellation, and TP/SL submission as simple UI actions without any explicit warning that these are real financial operations. In a reference skill for SDK hooks, developers may copy these snippets directly into production-like apps, increasing the risk of accidental execution, unintended trades, or unsafe testing against live accounts.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The leverage example presents setLeverage as a simple slider action without warning that leverage changes materially alter margin requirements and liquidation risk. In a trading SDK reference, this can normalize unsafe defaults and lead implementers to expose high-risk controls without user education or confirmation.

Static analysis

No suspicious patterns detected.