ClawHub
Back to skill

Security audit

BrainChain worker

Security checks for vulnerabilities and agentic risk

Overview

ClawScan rates this skill suspicious because scanners report an unpinned package run with wallet access and funding and staking operations beyond its described task-earning purpose.

Consider not installing until the package version and its source are reviewed, the wallet access and funding or staking actions are clearly understood, and you are comfortable with the reported external handling of task briefs. Scanner coverage is marked partial because a local reference in the skill could not be resolved, so the evidence is incomplete.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (17)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The description covers earning rewards through task execution, but the supplied commands instead fund and stake capital. These are material financial operations not disclosed by the description or declared permissions. The initial dry run does not make the subsequent non-dry-run command a simulation. Successful execution would depend on supplying an amount and having the necessary wallet access and funds.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: shell.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y brainchain-worker'.

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

The key-generation command executes an unpinned npm package on the host. A compromised future release could capture the newly generated wallet key or access other host resources; task-container isolation does not protect this command.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y brainchain-worker'.

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

The status command runs a mutable npm release with the worker's host privileges and potentially its signing credentials. Although this is a CLI rather than an MCP server, the unpinned executable dependency creates a genuine supply-chain exposure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

the request, so no curl is needed:

sh
node -e 'fetch("https://brain.testnet.usebrainchain.com/testnet/gas", { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ address: process.argv[1] }) }).then(async (r) => console.log(r.status, await r.text()))' <worker address>
npx -y brainchain-worker join --name "<name>" --about "<what this agent does well>" --price 0.20

MCP server referenced without pinned version: 'npx -y brainchain-worker'.

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

Joining executes an unpinned package in a context authorized to sign transactions and spend stake or gas. A malicious release could abuse that authority, regardless of the documented behavior of legitimate releases.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y brainchain-worker'.

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

The bridge command downloads and executes an unspecified package version with transaction-signing access. A compromised release could steal credentials or substitute unauthorized transfers before any task sandbox is involved.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y brainchain-worker'.

Medium
Category
MCP Rug Pull
Confidence
99% confidence
Finding

The background worker executes an unpinned npm release as a long-running host process with wallet access. A compromised update could steal keys, sign unauthorized transactions, or alter task execution; sandboxing individual tasks would not contain the worker itself.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y brainchain-worker'.

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

Even a status check executes arbitrary code from the currently resolved npm release, rather than merely reading chain data. Repeated operational checks can therefore introduce a newly compromised release into a host environment containing signing credentials.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y brainchain-worker'.

Medium
Category
MCP Rug Pull
Confidence
99% confidence
Finding

The dry-run funding command still executes an unpinned package with access to the configured Solana credentials. The --dry flag is implemented by that same package and cannot protect against a malicious release that ignores it.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y brainchain-worker'.

Medium
Category
MCP Rug Pull
Confidence
99% confidence
Finding

The live mainnet funding command executes a mutable package with authority over Solana funds and worker transactions. A compromised release could bypass the documented quote checks, redirect transfers, or extract wallet secrets.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

md
the 2 USDC, or `--gas-usdc`, and the rest stays on Solana. A move that would cost more than 3% on the gas or 5% on the
stake token (or 0.50 USD on a small one) stops before anything is signed, and so does a quote that asks to sign anything
but this deposit; try again later, or ask the operator to bring the stake token to Robinhood Chain and use `bridge`. If
`fund` stops after a move has left the wallet, it says what moved: tell the operator, and do not run it again without
checking, since another run moves more USDC.

Fast exits are off on mainnet, where `exit` says so and sends nothing, so earnings there come back through the bridge's

MCP server referenced without pinned version: 'npx -y brainchain-worker'.

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

The watch command executes the latest resolved npm package on the host, potentially with the worker's credentials. Its verification-oriented purpose does not prevent a compromised package from accessing secrets or executing unauthorized host actions.

Content

No source excerpt is available for this finding.

The task brief is routed to an external model provider without disclosure.

Medium
Category
Output Handling
Confidence
88% confidence
Finding

The command passes the stdin task brief to an agent configured by default to use an OpenRouter-hosted DeepSeek model. The script does not warn that brief contents may be transmitted to a third-party service; its introductory comment describes only stdin/stdout behavior.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

Low
Category
Tool Misuse
Confidence
15% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/setup.sh (reported line 11)May include surrounding context.

sh
ENV DEBIAN_FRONTEND=noninteractive
RUN apt-get update && apt-get install -y --no-install-recommends \
  bash ca-certificates curl git jq python3 ripgrep \
  && rm -rf /var/lib/apt/lists/*
RUN useradd --create-home --shell /bin/bash sandbox
USER sandbox
WORKDIR /home/sandbox

Tool Parameter Abuse

Low
Category
Tool Misuse
Confidence
15% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/setup.sh (reported line 11)May include surrounding context.

sh
ENV DEBIAN_FRONTEND=noninteractive
RUN apt-get update && apt-get install -y --no-install-recommends \
  bash ca-certificates curl git jq python3 ripgrep \
  && rm -rf /var/lib/apt/lists/*
RUN useradd --create-home --shell /bin/bash sandbox
USER sandbox
WORKDIR /home/sandbox

Chaining Abuse

Low
Category
Tool Misuse
Confidence
15% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/setup.sh (reported line 11)May include surrounding context.

sh
ENV DEBIAN_FRONTEND=noninteractive
RUN apt-get update && apt-get install -y --no-install-recommends \
  bash ca-certificates curl git jq python3 ripgrep \
  && rm -rf /var/lib/apt/lists/*
RUN useradd --create-home --shell /bin/bash sandbox
USER sandbox
WORKDIR /home/sandbox