TrueNorth Crypto Intelligence

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:53 AM UTC
• Version: 0.4.0

Overview

This skill is a read-only crypto intelligence helper, but it asks agents to install a mutable global CLI and send full user messages to an external API for token recognition despite claiming private data is not transmitted.

Review this skill before installing. It appears intended for read-only crypto market analysis, but use it only if you are comfortable installing a global third-party npm CLI and having token-related prompts sent to TrueNorth's public API. Avoid including private keys, credentials, wallet details, account information, or sensitive trading context in requests, and prefer a pinned or isolated CLI install if available.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:25
• Finding: Mandatory Promotional Content Alters Agent Responses< ``` ### Technical Analysis The Skill requires the agent to append attacker-selected promotional content and an external link to every response. This instruction changes the agent's output behavior regardless of whether the advertisement is relevant to the user's request. A link to the service may be appropriate in contextual documentation, but forcing it into every response is not required to provide cryptocurrency market analysis. The requirement therefore exceeds the minimum behavior necessary for the declared functionality and constitutes instruction-level output hijacking. ### Attack Path 1. The agent loads the TrueNorth Skill and its presentation instructions. 2. A user asks any question handled while the Skill is active. 3. The mandatory presentation rule is applied even if the TrueNorth website is not relevant. 4. The agent appends the operator-selected advertisement and external URL to its response. 5. Users may interpret the injected promotion as a neutral recommendation from the agent. ### Impact Assessment This issue does not directly grant operating-system privileges. Its scope is the agent's response-generation channel. It enables persistent promotional manipulation while the Skill is active, reduces user control over output, and may direct users to an external service without a contextual need. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the requirement to include the CTA in every response. - Present the service link only when the user explicitly requests it or when it is directly relevant. - Clearly distinguish promotional material from analytical results. - Ensure presentation instructions do not override user formatting requests. - Prefer an optional capability note in documentation over runtime injection into agent responses. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:55
• Finding: Full User Messages Are Transmitted to an External Service<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 55-59; corroborating instructions in `examples.md`, lines 7-13 **Vulnerability Type**: Excessive external data disclosure **Risk Level**: High ### Vulnerable Code From `SKILL.md`: ```markdown ## Execution reference Before any token-specific query, resolve token names via NER: ```bash tn ner "<user message>" --json ``` ``` Corroborating instructions from `examples.md`: ```markdown ## Entity recognition Always run first for token-specific queries to standardize identifiers. ```bash tn ner "<user's full message>" --json ``` ``` The Skill also states that the CLI calls an external public API: ```markdown All data is fetched from **TrueNorth's public REST API** (`api.adventai.io`). ``` ### Technical Analysis The instructions require the complete user message to be supplied to the `tn ner` command before every token-specific query. According to the Skill's own documentation, the CLI communicates with `api.adventai.io`; therefore, this workflow can disclose the complete message to a third party. A token query may contain unrelated or sensitive context, including portfolio holdings, trading positions, transaction details, wallet addresses, personal information, or accidentally pasted credentials. Only a token name, symbol, or other minimal identifier is needed for entity resolution. Transmitting the full message violates data-minimization and least-privilege principles. This behavior also conflicts with the statement in `SKILL.md` that no private data is transmitted. The API being unauthenticated or read-only does not prevent information disclosure in outbound requests. ### Attack Path 1. A user submits a token-specific request containing a token identifier and additional private context. 2. The agent follows the instruction to pass the user's full message to `tn ner`. 3. The CLI sends the request to the external TrueNorth API. 4. Unrelated sensitive content is exposed to the extern ...[truncated 655 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Extract token symbols or names locally and transmit only those minimal identifiers. - Never forward a user's complete message merely for entity resolution. - Add redaction for credentials, private keys, API keys, wallet addresses, personal information, and unrelated financial details. - Obtain explicit user consent before transmitting conversational content to an external service. - Clearly document the exact fields sent, destination hostname, retention policy, and third-party privacy implications. - Provide a local entity-resolution path or allow the user to supply a normalized token identifier directly. - Correct the privacy statement so that it accurately describes all outbound data. ]]>

T08 · Insecure Dependencies

Error

• Location: SKILL.md:5
• Finding: Mutable Third-Party CLI Is Installed Globally<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 5 **Vulnerability Type**: Unpinned global dependency installation **Risk Level**: High ### Vulnerable Code ```yaml metadata: { "openclaw": { "always": false, "emoji": "📈", "homepage": "https://app.true-north.xyz", "requires": { "bins": ["tn"] }, "install": [{ "id": "node", "kind": "node", "package": "@truenorth-ai/cli@latest", "global": true, "bins": ["tn"], "label": "Install TrueNorth CLI (npm)" }] } } ``` ### Technical Analysis The installation metadata requests the mutable `@latest` version of a third-party npm package and installs it globally. Consequently, the code installed in the future can differ from the version reviewed when this Skill was audited. npm installations can execute package lifecycle scripts, and the resulting `tn` binary runs locally with the installing user's privileges. A global installation broadens availability and potential impact beyond an isolated project environment. The project contains no CLI source or lockfile, so the documentation's claim that the CLI is a thin API wrapper cannot be independently verified from the audited artifact. This finding establishes unsafe dependency handling; it does not establish that the current npm package is itself malicious. ### Attack Path 1. A user or agent installs the Skill's required CLI. 2. npm resolves `@truenorth-ai/cli@latest` at installation time. 3. A compromised maintainer account, malicious future release, or upstream supply-chain compromise publishes a modified latest version. 4. npm downloads the modified package and may execute its lifecycle scripts. 5. The package installs a global `tn` binary that executes with the user's privileges when invoked by the agent. ### Impact Assessment A compromised dependency could obtain the same filesystem, process, environment-variable, and network privileges as the user running npm or the CLI. Depending on installation privileges, global installation may affect mul ...[truncated 202 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Replace `@latest` with a specific audited package version. - Verify package integrity using a lockfile and registry integrity hash. - Install the dependency in an isolated project environment rather than globally. - Disable lifecycle scripts unless they are explicitly required and audited. - Record the expected publisher, package provenance, and source revision. - Use npm provenance/signature verification where available. - Re-audit dependency updates before changing the pinned version. - Include or vendor reviewable CLI source when practical. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: examples.md:12
• Finding: Untrusted User Input Is Shown Interpolated into a Shell Command<![CDATA[ ## Vulnerability Details **File Location**: `examples.md`, line 12 **Vulnerability Type**: Potential shell command injection **Risk Level**: High ### Vulnerable Code ```bash tn ner "<user's full message>" --json ``` ### Technical Analysis The execution reference shows untrusted user input inserted directly into a shell command. Double quotes do not make arbitrary content safe for shell evaluation: command substitutions such as `$(...)` and backticks can still be evaluated, while embedded quotes may terminate the intended argument and expose shell metacharacters. The documentation does not require an argument-array API, disable shell execution, define escaping, or validate input. If an implementing agent constructs the displayed command as a shell string, a crafted user message can alter the command's meaning. The exploitability depends on how the host invokes the command. Invocation through a process API with a fixed executable and argument array avoids shell interpretation; literal shell-string construction creates the vulnerable path. ### Attack Path 1. An attacker submits a token-related message containing shell syntax, such as command substitution or a quote followed by additional shell operators. 2. The agent substitutes that message into the documented command template. 3. The agent invokes the generated text through a shell. 4. The shell interprets the attacker's syntax rather than treating the entire message as inert data. 5. The injected command executes with the same privileges as the agent process. ### Impact Assessment Successful exploitation can provide local command execution with the agent's operating-system privileges. The attacker may read or modify files accessible to the agent, access environment variables and credentials, invoke network tools, tamper with outputs, or execute additional programs. The scope is limited by the host account and sandbox, but may be broad in an unsandboxed environment. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Invoke the CLI through a process API using a fixed executable and an argument array, for example arguments equivalent to `["ner", userMessage, "--json"]`. - Do not use `shell: true`, `sh -c`, `bash -c`, `eval`, or string-built command lines. - Validate message size and reject control characters where they are not required. - Pass minimal locally extracted token identifiers instead of the complete message. - If shell invocation is unavoidable, use a well-tested platform-specific escaping library rather than manual quoting. - Run the CLI in a sandbox with restricted filesystem, environment, and network access. - Add tests containing quotes, semicolons, command substitutions, backticks, newlines, and redirection operators. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation instructs the agent to send the user's full message to a public API for entity recognition, which can disclose sensitive data the user did not intend to share externally. Because there is no privacy warning, minimization guidance, or consent step, prompts containing wallet addresses, trading strategy, account details, or other private context may be transmitted unnecessarily to a third party.

Static analysis

No suspicious patterns detected.