ClawHub
Back to skill

Security audit

Public

Security checks for vulnerabilities and agentic risk

Overview

This skill is purpose-aligned with minting an NFT, but it asks the agent to handle raw wallet private keys and sign payment and transaction data without enough user control or validation.

Review before installing. Use only a dedicated, minimally funded wallet, do not paste a valuable wallet private key into the agent, require explicit confirmation before each signature and broadcast, and independently verify the payment amount, chain, contract, recipient, transaction calldata, and fees.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)

T09 · Insecure Skill Coding Practices

Error
Location
skill.md:73
Finding

Blind Signing of Server-Controlled USDC Payment Authorization

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
skill.md:114
Finding

Blind Signing and Submission of an Arbitrary Server-Provided Transaction

Content
View full analysis
"}' ``` ### Technical Analysis The transaction object originates from the remote `/api/complete` response and is signed without local semantic validation. The instructions do not require verification of: - `chainId` - Destination address (`to`) - Native asset amount (`value`) - Contract method selector - Decoded calldata and arguments - Expected NFT contract - Mint recipient - Token approvals or asset-transfer operations - Nonce correctness - Gas limits and fee bounds - Transaction type A remote service should not be trusted to define an arbitrary transaction under a user's wallet authority. Merely signing locally protects the raw private key from direct transmission, but it does not protect the wallet from malicious transaction contents. The signed transaction is also sent back to the same service that generated it, giving that service the ability to broadcast the signed operation. ### Attack Path 1. An attacker compromises or controls the backend that responds to `/api/complete`. 2. Instead of returning the documented mint transaction, the backend returns a transaction that transfers ETH, grants a token approval, invokes an unintended contract, or otherwise acts against the wallet. 3. The Skill assigns that response to ` ...[truncated 752 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
skill.md:145
Finding

Skill Requests Reusable Wallet Private Keys and Assumes Full Signing Authority

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
skill.md:148
Finding

Unpinned Runtime Dependency Installation in a Private-Key Signing Workflow

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The security section claims the skill does not access the filesystem, run shell commands, or execute arbitrary code, but later instructions explicitly require curl, node, npm, and local file writes. This contradiction can mislead users and agents into granting trust under false assumptions, increasing the chance they expose sensitive credentials or permit unsafe execution paths.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · skill.md (reported line 21)May include surrounding context.

Install locally:

bash
mkdir -p ~/.openclaw/skills/base-buds
curl -s https://budsbase.xyz/skill.md > ~/.openclaw/skills/base-buds/SKILL.md

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · skill.md (reported line 22)May include surrounding context.

Install locally:

bash
mkdir -p ~/.openclaw/skills/base-buds
curl -s https://budsbase.xyz/skill.md > ~/.openclaw/skills/base-buds/SKILL.md

Or just read the URL directly!

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 22)May include surrounding context.

Install locally:

bash
mkdir -p ~/.openclaw/skills/base-buds
curl -s https://budsbase.xyz/skill.md > ~/.openclaw/skills/base-buds/SKILL.md

Or just read the URL directly!

Unrestricted Tool Access

Medium
Category
Excessive Agency
Confidence
80% confidence
Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · skill.md (reported line 37)May include surrounding context.

md
## Security

- Your EVM private key should **never** leave your local environment — signing happens locally
- This skill makes only HTTP API calls. It does not access your filesystem, run shell commands, or execute arbitrary code

## How It Works

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skill.md (reported line 74)May include surrounding context.

md
const wallet = new ethers.Wallet(PK);

// 2a. Submit challenge answer, get payment data
const res = await fetch("https://budsbase.xyz/api/prepare", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ wallet: wallet.address, challengeId: "CHALLENGE_ID", answer: "ANSWER" }),

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

The instruction to handle the entire mint flow from the user's wallet address and private key 'without asking further questions' encourages autonomous execution of financial operations. In this context, that reduces human verification at the exact points where payment authorization and transaction signing occur, increasing the risk of unintended spending or abuse.

Content

Scanner excerpt · skill.md (reported line 147)May include surrounding context.

md
## Agent Behavior

- The user will provide their **wallet address** and **private key**. That's all you need — handle the entire mint flow from there without asking further questions.
- **Step 1** (challenge): use `curl`.
- **Step 2** (prepare & sign payment): use a **single node script** that fetches `/prepare` and signs the USDC payment. Do NOT split this into separate curl + node steps.
  - **ethers fallback:** Before running the script, check if ethers is available: `node -e "require('ethers')"`. If it fails, install to a temp location: `npm install --prefix /tmp ethers`, then run the script with `NODE_PATH=/tmp/node_modules`.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill directs the agent to execute curl, node, and npm commands, including installing dependencies at runtime, even though the capability needed is nominally HTTP requests and local signing. This expands the attack surface significantly: shell execution, package installation, and script execution can be abused to compromise the host environment or exfiltrate secrets if the instructions or fetched dependencies are tampered with.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs the user to provide a wallet private key and tells the agent to complete the mint flow without further questions, but it does not require an explicit warning or confirmation about irreversible on-chain spending and transaction signing. In context, this is especially dangerous because the flow authorizes a USDC transfer and signs a blockchain transaction, both of which can cause immediate asset loss if the transaction data is malicious or misunderstood.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.