ClawHub
Back to skill

Security audit

BitNow

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a disclosed OpenBytes API workflow guide, but it includes risky secret-handling and account-control instructions that users should review before installation.

Install only if you are comfortable reviewing and constraining the workflows yourself. Do not let an agent generate, print, store, or receive wallet private keys or seed phrases; redact session tokens, API keys, signatures, and authorization headers before sharing responses; require explicit confirmation before revoking keys or linking wallets; and prefer externally managed wallet software for signing.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:35
Finding

Generated Wallet Private Key Exposed in Plaintext Terminal Output

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 35–39 and 44–48
Vulnerability Type: Plaintext sensitive data exposure
Risk Level: High

Vulnerable Code

js
import { Wallet } from "ethers";
const wallet = Wallet.createRandom();
console.log("Address:", wallet.address);
console.log("Private Key (save this securely!):", wallet.privateKey);
js
import { createWallet } from "viem/accounts";
const wallet = createWallet();
console.log("Address:", wallet.address);
console.log("Private Key (save this securely!):", wallet.privateKey);

Technical Analysis

Both recommended wallet-generation examples print the newly generated private key as plaintext. A private key is a complete bearer secret: possession of it is sufficient to impersonate the wallet owner and authorize blockchain transactions.

Terminal output may be retained in shell scrollback, CI/CD logs, command transcripts, screen recordings, remote-session logs, observability platforms, or AI-agent conversation history. The accompanying instruction to save the key securely does not prevent its initial disclosure through these channels.

Attack Path

  1. A user or automation agent follows one of the documented wallet-generation examples.
  2. The generated private key is printed to standard output.
  3. The terminal output is stored in a log, transcript, screen recording, or other monitoring system.
  4. An unauthorized user or compromised service obtains access to that output.
  5. The attacker imports the private key into a wallet or signing library.
  6. The attacker signs transactions as the victim and transfers wallet assets or performs other wallet-authorized operations.

Impact Assessment

Successful exploitation provides full control over the generated EVM wallet. The attacker can sign arbitrary transactions, transfer tokens, interact with contracts, and impersonate the wallet in signature-based authentication workfl ...[truncated 177 chars]

Remediation
View remediation

Remediation Suggestions

  • Do not print private keys to standard output or expose them to an AI agent.
  • Recommend creating wallets through a trusted wallet application or hardware wallet.
  • If programmatic generation is required, store the key directly in an encrypted keystore protected by a strong password.
  • Apply restrictive filesystem permissions before writing any sensitive material.
  • Prevent wallet secrets from entering application, CI/CD, telemetry, or conversation logs.
  • Display only the public wallet address after generation.
  • Add an explicit warning that users must never paste private keys, seed phrases, or keystore passwords into support requests or agent conversations.
  • Treat any key generated using the existing examples and captured in logs as compromised; move assets to a newly generated secure wallet and retire the exposed key.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:271
Finding

Troubleshooting Guidance Requests Potentially Unredacted Authentication Responses

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 271–275
Vulnerability Type: Sensitive authentication data disclosure
Risk Level: Medium

Vulnerable Code

text
3. When troubleshooting:
   - Request the **full API HTTP response** (status + JSON).
   - Use `error.code` and context to select remediation steps.

Technical Analysis

The skill tells agents to request the full JSON response during troubleshooting but does not require sensitive fields to be redacted. Elsewhere in the same document, authentication responses are shown as containing a login_token, while API-key creation responses contain the one-time api_key.

Session tokens and consumer API keys are bearer credentials. Anyone who obtains a valid credential may exercise the permissions granted to it without proving possession of the corresponding wallet. Requesting full responses can therefore cause secrets to be copied into agent conversations, support tickets, logs, or other systems with broader access and longer retention than the original client environment.

Attack Path

  1. A user experiences an authentication or API-key creation problem.
  2. Following the troubleshooting guidance, the agent asks for the full HTTP status and JSON response.
  3. The user supplies an unredacted response containing a session token, consumer API key, or related sensitive value.
  4. The response is retained in conversation history, support infrastructure, telemetry, or logs.
  5. An unauthorized party with access to one of those systems extracts the bearer credential.
  6. The party reuses the credential against the OpenBytes gateway until it expires or is revoked.

Impact Assessment

A leaked session token may enable authenticated session operations, including API-key lifecycle actions supported by that session. A leaked consumer API key may enable paid model inference and access to balance or usage information. The precise scope depends on ...[truncated 222 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace the request for a “full API HTTP response” with a request for the status code, sanitized error.code, and only the minimum non-sensitive context needed for diagnosis.
  • Require users to redact Authorization headers, login_token, api_key, signatures, cookies, private keys, seed phrases, and other credentials before sharing output.
  • Provide a concrete sanitized-response example and a checklist of prohibited fields.
  • Configure support and observability systems to automatically detect and mask known credential formats such as session-token and consumer-key prefixes.
  • Avoid debug modes that record HTTP authorization headers or complete authentication responses.
  • If a credential has already been disclosed, revoke or rotate it immediately, terminate affected sessions where supported, and review usage records for unauthorized activity.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill goes beyond describing OpenBytes API interaction and instructs users to generate wallets and expose raw private-key material in CLI output. In an agent context, expanding into secret generation/handling increases the chance that a model creates, stores, logs, or retransmits highly sensitive credentials outside the user’s intended scope.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The wallet creation guidance is not necessary for the stated API-operations purpose and directly encourages generation and handling of private keys within agent-assisted workflows. In practice, this can lead to secret exposure through terminal history, logs, chat transcripts, or model memory, creating a concrete credential-compromise risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

  1. Submit the signed message to the gateway for verification:
sh
curl -sS -X POST "<BASE_URL>/v1/auth/wallet/verify" \
  -H "Content-Type: application/json" \
  -d '{
    "wallet_address": "<EVM_WALLET_ADDRESS>",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The revocation command is destructive and can disable production integrations, yet the skill presents it as a direct one-step action without requiring explicit confirmation or warning about irreversibility. In an agent setting, this raises the risk of accidental service disruption from misunderstood or overly automated execution.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The parent-child wallet linking workflow materially expands the skill’s capabilities beyond the declared manifest scope. Because it authorizes an account relationship with financial implications, undocumented scope expansion can mislead users and agents into performing higher-risk account actions they did not expect from a simple API operations skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.