ClawHub
Back to skill

Security audit

Ganglion Synth City

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed guide for running Ganglion-based Bittensor Synth forecasting workflows, with no hidden execution or credential handling found.

Before installing, be comfortable with running Ganglion and curl for crypto-forecasting workflows. Check that GANGLION_URL points to the intended local or trusted server, and install Python dependencies in a virtual environment with pinned versions when possible.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:196
Finding

Unpinned Third-Party Python Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 196
Vulnerability Type: Unpinned and unverified third-party dependency
Risk Level: Medium

Vulnerable Code Snippet:

markdown
- `properscoring` — CRPS calculation (`pip install properscoring`)

Technical Analysis

The documented command installs the latest available release of properscoring without a version constraint, cryptographic hash verification, lockfile, or reviewed source reference. Consequently, the dependency resolved during installation may differ from the version reviewed or tested by the project.

Python package installation can execute package-controlled build and installation logic. If the upstream package, its publishing account, or the package repository is compromised, a malicious release could execute code when a user follows this instruction. This is a supply-chain weakness rather than evidence that the currently published package is malicious.

Attack Path

  1. An attacker compromises the dependency's publisher account, distribution infrastructure, or upstream release process.
  2. The attacker publishes a malicious release under the expected package name.
  3. A user follows the documented pip install properscoring instruction.
  4. pip resolves and downloads the attacker-controlled release because no reviewed version or hash is required.
  5. Malicious build or installation logic executes with the privileges of the user running pip.
  6. The payload may subsequently affect applications that import the installed package.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's account. The resulting scope may include access to that user's files, environment variables, credentials, network access, and writable project resources. If the command is run from an administrator or root context, the impact could extend to system-wide modification. The file contains docu ...[truncated 193 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin properscoring to a specific version that has been reviewed and tested.
  • Provide a lockfile or requirements file containing cryptographic hashes, and install with pip --require-hashes.
  • Prefer binary wheels from trusted sources where appropriate, and restrict package indexes to explicitly approved repositories.
  • Install dependencies in an isolated virtual environment using a non-privileged account.
  • Add dependency vulnerability and provenance scanning to the release process.
  • Periodically review and deliberately update the pinned version instead of resolving an unrestricted latest release during installation.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 175)May include surrounding context.

bash
# 1. Fetch 48h of BTC history at 5-min intervals
curl -s -X POST "$GANGLION_URL/v1/run/experiment" \
  -H "Content-Type: application/json" \
  -d '{"config": {"tool": "fetch_historical_prices", "asset": "BTC", "hours_back": 48, "time_increment": 300}}' \
  | jq .data

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.

bash
# 1. Fetch 48h of BTC history at 5-min intervals
curl -s -X POST "$GANGLION_URL/v1/run/experiment" \
  -H "Content-Type: application/json" \
  -d '{"config": {"tool": "fetch_historical_prices", "asset": "BTC", "hours_back": 48, "time_increment": 300}}' \
  | jq .data

Static analysis

No suspicious patterns detected.