ClawHub
Back to skill

Security audit

区块链安全基础版

Security checks for vulnerabilities and agentic risk

Overview

The skill is not clearly malicious, but it needs Review because it asks for broad shell access while relying on unclear external API endpoints for wallet safety decisions.

Install only if you are comfortable with the agent using shell commands for API calls and sending wallet or token addresses, chain IDs, and tracking identifiers to an unspecified external service. Treat any safety result as advisory until the publisher provides a canonical HTTPS endpoint, clear privacy terms, and narrower execution scope.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:88
Finding

Linkable Blockchain Query Data Is Disclosed to an External Service

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 88-91 and 122
Vulnerability Type: External disclosure of linkable wallet-query information
Risk Level: Medium

Vulnerable Code

bash
# Query free quota
curl "https://security-api.example.com/v1/usage" \
  -H "X-Client-Fingerprint: agent-default"

The documentation also states that the service falls back to the caller's IP address and User-Agent when the fingerprint header is absent.

Technical Analysis

The Skill instructs the Agent to send a stable X-Client-Fingerprint to an external API. Address and token inspection requests additionally disclose blockchain addresses and chain IDs. The service can associate these queries with the supplied fingerprint and, through ordinary network metadata, the caller's IP address and User-Agent.

Sending an address or token identifier is necessary for the advertised remote reputation check. However, a stable client fingerprint is required for quota accounting rather than for the core security analysis. The hardcoded agent-default value also does not provide meaningful client authentication or isolation. The Skill does not identify the actual service operator, state a retention policy, require informed user consent, or provide a privacy-preserving alternative.

This is not covert credential exfiltration, and blockchain addresses are generally public. Nevertheless, the collection of repeated queries can reveal which wallets, tokens, or intended transactions interest a particular caller.

Attack Path

  1. A user asks the Agent to assess a wallet or token before a transaction.
  2. The Agent sends the address, chain ID, and stable client fingerprint to the remote API.
  3. The API operator records the submitted values and network metadata.
  4. Repeated checks are correlated through the fingerprint, IP address, or User-Agent.
  5. The resulting profile may reveal wallet interests, token research, or prospecti ...[truncated 504 chars]
Remediation
View remediation

Remediation Suggestions

  1. Require explicit user approval before transmitting wallet or token queries to an external service.
  2. Identify the real API operator and provide links to its privacy, retention, and deletion policies.
  3. Clearly disclose every transmitted field, including address, chain ID, fingerprint, IP address, and User-Agent.
  4. Replace the shared agent-default value with a random, scoped, and periodically rotated quota identifier.
  5. Avoid silently falling back to IP/User-Agent fingerprinting. If fallback is unavoidable, disclose it before the request and allow the user to decline.
  6. Minimize server logs and define short retention periods for query data and network metadata.
  7. Offer a local or privacy-preserving lookup mode where practical.
  8. Ensure API keys, if later used, are sent only to a verified HTTPS origin and are never logged.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:105
Finding

Placeholder and Malformed API Commands Prevent Verification of Security Results

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 105-114
Vulnerability Type: Unverifiable external API destination and malformed command examples
Risk Level: Medium

Vulnerable Code

bash
# Check address safety on Base
example.com/v1/check-address/0x742d35Cc6634C0532925a3b844Bc454e4438f44e?chain_id=8453" \
  -H "X-Client-Fingerprint: agent-default"
bash
example.com/v1/check-token/0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48?chain_id=1" \
  -H "X-Client-Fingerprint: agent-default"
# Response includes honeypot probability, riskLevel, threatSignals, and other fields

Technical Analysis

The documented address and token examples omit the curl command, URL scheme, and opening quotation mark. The only domain shown is example.com, which is a reserved documentation placeholder rather than an identifiable production security service.

Consequently, the reviewed project does not establish an authentic API origin, certificate expectations, authentication mechanism, or response trust boundary. An Agent attempting to repair the examples may guess or accept a user-controlled endpoint. An Agent may also treat a failed or fabricated response as a valid security result if failure handling is not enforced.

Because the Skill's declared purpose is to make transaction-safety recommendations, endpoint authenticity and strict response validation are essential. A result from an unverified service could incorrectly classify a malicious address or honeypot token as safe.

Attack Path

  1. The Agent attempts to perform a wallet or token safety check using the documented example.
  2. The command fails because it lacks a valid invocation and complete HTTPS URL, or the Agent reconstructs the missing details.
  3. A user, surrounding prompt, or configuration supplies an attacker-controlled API origin.
  4. The attacker-controlled endpoint returns a fabricated response such as isSafe: true or a low hon ...[truncated 797 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the placeholder domain with one canonical, operator-controlled HTTPS API origin.
  2. Provide syntactically complete commands, including curl, https://, balanced quotation marks, and all required headers.
  3. Do not permit prompts or untrusted input to override the API origin.
  4. Pin the allowed hostname in the Skill instructions and reject redirects to unrelated hosts.
  5. Document the authentication method and ensure credentials are sent only to the approved origin.
  6. Validate HTTP status codes, content type, and a strict response schema before consuming results.
  7. Fail closed on DNS errors, TLS errors, timeouts, authentication failures, malformed JSON, or missing security fields.
  8. Distinguish clearly between “safe,” “unsafe,” and “check unavailable.” Never represent an unavailable check as a successful safety verdict.
  9. Consider cryptographically signed responses if results pass through untrusted infrastructure.
  10. Add tested examples for both supported chains and automated checks that reject malformed documentation commands.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

Granting exec to a blockchain address/token reputation checking skill is unnecessary based on the described functionality, which only requires HTTP requests and formatting results. Unneeded command execution enables abuse such as local reconnaissance, file access via shell utilities, or invocation of other system tools if the agent exposes the capability during normal skill use.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The invocation guidance is broad and vague, including generic security, compliance, quality inspection, and encryption scenarios, which can cause the skill to activate outside its narrow intended purpose of address/token safety checks. Over-broad triggering is risky because it may route unrelated user tasks into a skill with unnecessary execution capability and networked data handling.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description states "支持中文交互" as part of the skill behavior, and the rest of the file is effectively presented only in Chinese without any indication that users may choose another language. This creates a locale/language constraint that is not presented as optional or justified as a region-specific requirement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill describes sending an X-Client-Fingerprint identifier and falling back to IP/User-Agent-based quota tracking, but it does not present a clear user-facing privacy notice or consent mechanism. This creates privacy and compliance risk because persistent identifiers and network metadata may be transmitted or derived without the user's informed awareness.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill documentation repeatedly states the free edition is limited to read-only blockchain safety checks and does not support transaction simulation, yet the manifest declares exec capability. This mismatch expands the effective attack surface because an agent may permit shell command execution under a skill that users and policy layers would reasonably expect to be network-read-only.

Content

No source excerpt is available for this finding.