Security audit

clawmegle staking

Security checks for vulnerabilities and agentic risk

Overview

This staking skill mostly does what it says, but it handles real wallet transactions and credentials with weak safeguards and contains an exploitable shell/Python input-handling flaw.

Review carefully before installing. Use only a low-value dedicated wallet or tightly scoped Bankr key, restrict config-file permissions, verify contract addresses independently, and require human confirmation before any approve, stake, unstake, claim, or reward-deposit transaction. Do not pass untrusted amounts to deposit-rewards.sh until its input parsing is fixed.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/deposit-rewards.sh:34
Finding: Arbitrary Python Code Execution Through Unsanitized Reward Amounts
Content: View full analysis
Remediation: View remediation
= 2**256: raise SystemExit("Amount is outside uint256 range") print(format(value, "064x")) PY ) ``` 5. Add automated tests using malformed input containing quotes, semicolons, newlines, shell metacharacters, exponent notation, negative values, and values outside the `uint256` range. 6. Require explicit transaction confirmation displaying the validated decimal amount, wei amount, chain, token, and destination contract before submitting a deposit. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:54
Finding: Transaction-Capable Bankr API Key May Be Stored with Insecure File Permissions
Content: View full analysis
~/.clawdbot/skills/bankr/config.json << 'EOF' { "apiKey": "bk_YOUR_API_KEY_HERE", "apiUrl": "https://api.bankr.bot" } EOF ``` ### Technical Analysis The documented setup writes a Bankr API key to a plaintext JSON file without explicitly setting a restrictive `umask`, directory mode, or file mode. The resulting permissions depend on the user's current umask and any pre-existing directory permissions. In an environment with a permissive umask, the configuration file may be readable by members of the user's group or by other local users. The documentation specifically instructs users to enable Bankr “Agent API” access, which is required for transactions, so disclosure may expose more than read-only account information. Plaintext credential storage may be necessary for the dependent tool, but the file should be created with owner-only permissions. The current instructions do not establish that protection. ### Attack Path 1. A user follows the documented configuration steps on a shared system or in an environment with a permissive umask. 2. `config.json` is created with group-readable or world-readable permissions, or it is placed inside a directory that does not sufficiently restrict traversal. 3. Another local user or compromised process enumerates the predictable path `~/.clawdbot/skills/bankr/config.json`. 4. The unauthorized party reads the Bankr API key. 5. The key is used against the Bankr API within the permissions granted to it. 6. If transaction authority is enabled and no additional confirmation control blocks the request, the exposed credential may be used to initiate unauthorized wallet operations. ### Impact Assessment The immediate impact is disclos ...[truncated 774 chars]
Remediation: View remediation
"$HOME/.clawdbot/skills/bankr/config.json" <<'EOF' { "apiKey": "bk_YOUR_API_KEY_HERE", "apiUrl": "https://api.bankr.bot" } EOF chmod 600 "$HOME/.clawdbot/skills/bankr/config.json" ``` Additional hardening should include: 1. Verify ownership and permissions before using the credential: ```bash test "$(stat -c '%a' "$HOME/.clawdbot/skills/bankr/config.json")" = "600" || { echo "Refusing to use insecure Bankr config permissions"; exit 1; } ``` 2. Refuse configuration files owned by another user or stored through an unexpected symbolic link. 3. Prefer an operating-system credential store or secret manager if supported by the Bankr integration. 4. Use a dedicated API key with the minimum permissions required for staking operations. 5. Enable transaction confirmation, destination allowlisting, spending limits, and withdrawal restrictions where Bankr supports them. 6. Never include real API keys in documentation, logs, shell history, support requests, or source control. 7. Document immediate key revocation and rotation procedures for suspected disclosure. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (26)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared description is specifically about staking $CLAWMEGLE and managing related rewards. The provided code does not perform staking, reward checks, claims, wallet transactions, or Bankr API calls itself. Instead, it only locates another script on disk and delegates execution to it. That is a materially different primary purpose from the declared staking functionality, so this is a mismatch.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description presents a user-facing staking management skill: staking tokens, checking rewards, claiming earnings, and managing a staking position. The supplied code does something materially different and much narrower: it funds the staking contract's rewards pool by optionally approving CLAWMEGLE and then calling depositRewards with ETH and token amounts. The script even states that this is not for staking and that staking should use a different script. Depositing protocol rewards is not the same as staking, checking rewards, claiming, or position management, so the primary purpose does not accurately match the code chunk.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The code chunk’s actual behavior is narrower than the declared description. It performs a two-step staking operation via Bankr: approval plus contract call to stake a specified amount of CLAWMEGLE on Base. There is no implementation for reading reward state, claiming ETH/CLAWMEGLE rewards, unstaking, or other position-management actions. The description also claims support for direct wallet transactions, but this code uses only a Bankr shell wrapper. This is a material description-to-behavior mismatch because the declared purpose presents a broader multi-function staking skill than the supplied code actually provides.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The code’s primary purpose partially overlaps with the description because it does stake CLAWMEGLE tokens. However, the declared purpose describes a multi-function staking skill with reward checking, earnings claiming, broader position management, and dual support paths (Bankr API plus direct wallet transactions). This specific code chunk only implements one narrow action: direct on-chain staking through cast send using a private key. That makes the description materially broader than the actual behavior of the supplied code chunk.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.
md
./scripts/stake-bankr.sh 1000

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.
md
./scripts/unstake-bankr.sh 500

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation instructs users to export a private key into the shell environment without a strong warning about key theft, shell history exposure, process inspection, or wallet-draining risk. In an agent-driven setting, encouraging raw private-key handling materially increases the blast radius of any compromise and bypasses safer signing patterns.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 228)May include surrounding context.
md
- [Bankr Transaction Format](references/bankr-format.md)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script’s documented purpose is administrative reward funding, not end-user staking, claiming, or position management as described in the skill metadata. In an agent setting, this capability can cause the agent to send ETH and approve/transfer CLAWMEGLE to a staking contract under the guise of normal user operations, creating a dangerous mismatch between declared scope and actual authority.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This code performs privileged reward distributor actions: it approves CLAWMEGLE spending and submits a depositRewards transaction with ETH value to the staking contract. That is materially different from helping a user manage their own staking position, and if exposed through an agent skill it could be abused to drain the operator wallet into protocol reward funding or to execute unintended token approvals.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The heartbeat instructs the agent to run a claim script automatically once a reward threshold is met, but it does not require explicit user confirmation or prominently warn that claiming is a state-changing onchain transaction. In an autonomous agent setting, this can cause unintended blockchain actions, gas expenditure, and asset movement based only on periodic checks rather than fresh user approval.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The decision logic says that if the position is staked and the agent 'want[s] to exit,' it should call unstake, but it provides no explicit warning that unstaking is a state-changing transaction that can materially alter the user's position and may have irreversible market or timing consequences. In a staking-management skill, this is especially dangerous because an agent could translate ambiguous intent into immediate onchain execution affecting custody, rewards, and strategy.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 33)May include surrounding context.
md
## Setup (One-Time) ### 1. Create Bankr Account 1. Go to **[bankr.bot](https://bankr.bot)** and sign up with email 2. Enter the OTP sent to your email

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README instructs users to place a Bankr API key in a local config file but does not warn about credential sensitivity, filesystem permissions, or avoiding source control exposure. Because the key appears to grant agent API access over wallets, leakage could enable unauthorized account actions, balance queries, or transaction initiation depending on API scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README encourages users to run stake, claim, and unstake scripts but does not clearly warn that these actions submit live on-chain transactions that move assets and consume gas. In a wallet/agent skill context, this can cause users or autonomous agents to trigger irreversible fund movements without adequate operator awareness, increasing the risk of unintended staking, claims, or gas spending.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The top-level description omits that the skill can deposit rewards for all stakers, which is materially different from ordinary user staking and claiming. Understating that capability can cause an agent or operator to invoke the skill in a broader-trust context than intended, increasing the chance of unintended fund movement.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The description is broad enough to match generic token-management requests, which can cause over-triggering of a skill that handles financial transactions. In agent systems, ambiguous activation increases the risk of the wrong skill being selected and submitting approvals, staking, or reward-deposit actions in an unintended context.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 84% confidence
Finding: The skill tells users to persist a long-lived Bankr API key in a predictable plaintext path under the home directory. Persistent agent-capable credentials stored locally can be reused by malware, other local users, or compromised tooling to initiate transactions or query wallet data without further authentication.
Content: Scanner excerpt · SKILL.md (reported line 46)May include surrounding context.
md
### Step 2: Get Your API Key 1. **Go to [bankr.bot/api](https://bankr.bot/api)** 2. **Create a new API key** 3. **Enable "Agent API" access** (required for transactions) 4. **Copy the key** (starts with `bk_`)

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The file makes strong security assurances such as 'No admin keys' and 'Audited patterns' while earlier stating the contract deployment is pending. Security claims about a not-yet-deployed or not-yet-verified contract can create false trust and may lead users to authorize transactions without independent verification of the actual deployed bytecode and ownership model.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The document provides copy-pastable raw transaction and approval examples for staking, claiming, and unstaking without any safety guidance about verifying contract addresses, calldata, token approvals, chain selection, or the irreversible nature of signed on-chain actions. In an agent skill context, this is more dangerous because an automated system may relay or construct these transactions for users, increasing the chance of accidental fund movement or overbroad approvals without informed confirmation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation includes concrete on-chain interaction examples for a staking contract without clearly warning that these functions can trigger irreversible asset movements, token approvals, claims, and gas expenditure. In an agent skill context, this omission is more dangerous because automated systems or users may treat the examples as safe operational guidance and execute value-bearing transactions without sufficient confirmation or risk awareness.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script constructs and prints an ERC-20 approve transaction followed by a staking transaction that can move real funds, but it does not present any explicit warning, confirmation step, or summary of the financial consequences. In an agent skill context, this is more dangerous because an automated system may surface or execute these steps with reduced human scrutiny, increasing the chance of accidental irreversible token approval and staking.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The script requires a raw PRIVATE_KEY in an environment variable and uses it directly for transaction signing. While this is common in automation, it increases the risk of credential exposure through shell history, process environment leakage, CI logs, or accidental reuse in unsafe contexts, especially since the skill is intended for agent-driven wallet operations on mainnet.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script performs two live on-chain actions—token approval and staking—without any explicit user confirmation, dry-run summary, or prominent warning that assets will be moved irreversibly. In an agent skill context, this is more dangerous because automated systems may invoke the script with user-supplied amounts or as part of a workflow, making accidental approvals and staking more likely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script directly submits an on-chain unstake transaction using the configured private key without any interactive confirmation, dry-run summary, or explicit warning that this is an irreversible blockchain action. In an agent skill context, this is more dangerous because an automated workflow, prompt injection, or parameter mistake could trigger immediate unstaking and reward claiming without the operator noticing before funds are moved.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.