Security checks for vulnerabilities and agentic risk
Overview
This skill is openly about high-leverage crypto trading, but it needs review because it encourages live 50x exchange actions without clear safeguards and uses an unpinned remote run command.
Only use this after carefully reviewing the actual runtime implementation. Prefer paper trading first, use dedicated low-permission exchange API keys with withdrawals disabled, set hard exchange-side limits, and avoid unpinned `npx` execution for any tool that can affect real funds.
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
T08 · Insecure Dependencies
Error
Location
SKILL.md:21
Finding
Unpinned Third-Party Package Execution Through npx
Content
View full analysis
Vulnerability Details
File Location: SKILL.md, lines 21–23 Vulnerability Type: Unpinned and unaudited third-party dependency execution Risk Level: High
Vulnerable Code
bash
## Usage
```bash
npx openclaw skill run micro-snowball
text
The operative command is:
```bash
npx openclaw skill run micro-snowball
Technical Analysis
The documented command invokes the openclaw npm package through npx without specifying an exact version or integrity constraint. If the package is not already installed in the local environment, npx may retrieve it from the configured npm registry and execute its package code with the invoking user's privileges.
The project provides no lockfile, package manifest, integrity hash, verified package source, or vendored implementation that would bind the command to a reviewed artifact. Consequently, the code executed by this instruction can differ from the content audited in this repository. The repository also contains no implementation for the advertised exchange operations, so API credential handling, trade authorization, leverage limits, and loss controls cannot be verified.
This is a supply-chain weakness rather than proof that the current openclaw package is malicious. Exploitation depends on an attacker compromising the package, its maintainer account, the package-resolution path, or the configured registry.
Attack Path
An attacker compromises the relevant npm package, its publisher credentials, or a registry/package-resolution mechanism.
The attacker publishes or serves a modified package version containing malicious lifecycle or runtime code.
A user follows the documented instruction and runs npx openclaw skill run micro-snowball.
Because no exact version or integrity value is specified, npx resolves and potentially downloads the attacker-controlled package.
The retrieved package executes under the user's local account
...[truncated 1077 chars]
Remediation
View remediation
Remediation Suggestions
Replace the unversioned command with an exact, reviewed package version, for example:
bash
npx --yes openclaw@<audited-exact-version> skill run micro-snowball
An exact version reduces unexpected updates but does not by itself provide complete integrity protection.
Add a package manifest and lockfile generated from the reviewed dependency set, and execute the locally installed locked binary rather than downloading code on demand.
Record and verify package integrity metadata and document the package's official publisher and repository.
Audit the actual implementation responsible for exchange communication before recommending execution.
Run the package in a restricted environment with minimum filesystem access, a constrained environment-variable set, and network access limited to required exchange endpoints.
Use exchange API keys dedicated to this skill with only the minimum trading permissions. Disable withdrawals and apply exchange-supported IP allowlists, position limits, and subaccount isolation.
Require explicit user confirmation and enforce server-side limits before changing leverage or submitting trades.
Document credential storage, logging redaction, order-size limits, maximum loss controls, and emergency shutdown behavior.
The skill explicitly promotes forced 50x isolated leverage, minimal-capital live trading, and DCA recovery behavior without prominent warnings about liquidation risk, automation risk, exchange-side consequences, or suitability constraints. In this context, the dangerousness is increased because the skill is framed as a disciplined framework, which can give users false confidence while normalizing extremely high-risk trading actions that may trigger rapid financial loss.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The skill instructs users to run npx openclaw without pinning an exact version, which allows whatever package version is current at execution time to be fetched and run. In a finance-themed skill that encourages automated exchange interaction and leveraged trading, this creates a meaningful supply-chain risk because a compromised or malicious package update could execute arbitrary code or manipulate trading behavior.
