ClawHub
Back to skill

Security audit

OpenBytes

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a legitimate OpenBytes API guide, but it includes unsafe credential-handling instructions that could expose wallet private keys, API keys, or session tokens.

Review this skill before installing. Do not let an agent generate or display wallet private keys, do not paste unredacted API responses into chat, and confirm any API-key creation, revocation, top-up, or parent-wallet linking action before running the suggested commands.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:31
Finding

Wallet Private Key Exposed Through Standard Output

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:131
Finding

API Key Placed in Shell Environment and Potentially Shell History

Content
View full analysis
/v1/balance" \ -H "Authorization: Bearer $OPENBYTES_API_KEY" ``` ``` ### Technical Analysis The Skill directs users to assign a bearer API key using an interactive shell command. When a real key replaces the placeholder, the literal command can be retained in shell history. Exporting the variable also propagates it to child processes, increasing the number of processes and diagnostic artifacts through which the credential may be exposed. Environment variables are frequently captured by process diagnostics, crash reports, debugging tools, CI job metadata, support bundles, and incorrectly configured telemetry. While environment variables are preferable to embedding a key directly in every command, the Skill does not describe protections against history retention, environment inheritance, or logging. Because the API key is a bearer credential, possession is sufficient for authenticated operations within the permissions assigned to that key. ### Attack Path 1. The user replaces `sk-consumer-...` with a real API key and executes the documented `export` command. 2. The command containing the literal secret is stored in shell history, or the exported value is inherited by a child process. 3. An attacker with access to the account’s history file, process diagnostics, CI logs, crash reports, or support artifacts retrieves the key. 4. The attacker submits the key in an `Authorization: Bearer` header to the OpenBytes gateway. 5. The attacker performs operations allowed to consumer API keys until the credential is revoked. ### Impact Assessment A stolen consumer API key can enable unauthorized model i ...[truncated 438 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:270
Finding

Troubleshooting Guidance Requests Unredacted API Responses

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill goes beyond describing OpenBytes API usage by instructing users or agents to create a new wallet and print its private key to stdout. In an agent-driven environment, terminal output, logs, chat history, or tool traces may expose the private key, enabling full compromise of funds and account control.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation tells users to print newly generated private keys and later handle API keys, but does not warn about exposure through shell history, terminal scrollback, CI logs, agent transcripts, or observability systems. In an AI-agent context, this greatly increases the chance that highly sensitive credentials are captured and replayed by unintended parties.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

  1. Submit the signed message to the gateway for verification:
sh
curl -sS -X POST "<BASE_URL>/v1/auth/wallet/verify" \
  -H "Content-Type: application/json" \
  -d '{
    "wallet_address": "<EVM_WALLET_ADDRESS>",

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documented parent/child wallet-linking capability materially expands the skill beyond the manifest description, increasing available account-control functionality without clear declaration. Undeclared privileged actions make it easier for an agent or user to invoke sensitive wallet-relationship changes unexpectedly, which can lead to misconfiguration or unauthorized account linkage.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.