ClawHub
Back to skill

Security audit

Broadcast Signed Transaction

Security checks for vulnerabilities and agentic risk

Overview

The skill performs its stated transaction-broadcasting job, but it handles sensitive OKX credentials and irreversible blockchain broadcasts with some under-scoped and under-documented behavior.

Review this before installing if you will use real OKX credentials or broadcast valuable transactions. Prefer environment variables or a secret manager over command-line credential flags, use narrowly scoped OKX Web3 API keys, confirm the signed transaction and chain before broadcast because it cannot be undone, and install dependencies in a pinned virtual environment.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/broadcast_signed_tx.py:321
Finding

OKX Credentials Exposed Through Command-Line Arguments

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
SKILL.md:265
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

Tainted flow: 'headers' from os.environ.get (line 184, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/broadcast_signed_tx.py (reported line 189)May include surrounding context.

python
# 发起请求
    try:
        resp = requests.post(
            OKX_BASE_URL + BROADCAST_PATH,
            headers=headers,
            data=body_str.encode("utf-8"),

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The declared purpose says the skill simply broadcasts signed hex transactions without private keys, but the documented behavior also relies on undeclared external OKX credentials, adds MEV-protection behavior, and references chains like Solana that do not match the stated EVM/hex transaction model. This mismatch is dangerous because operators and agents may trust a narrower safety profile than the skill actually has, leading to misuse, accidental credential handling, incorrect transaction assumptions, or broadcasting on unintended chains/providers.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill declares no explicit tool scope or permissions despite clearly requiring environment variable access and outbound network access to OKX APIs. This creates an authorization transparency gap: an agent or user may invoke the skill without understanding it can read local secrets and send data externally, increasing the risk of unintended credential exposure or overbroad execution in permissive runtimes.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest describes the skill as broadcasting signed hex transactions, which implies EVM-style hex payloads. However, the code explicitly adds Solana support in CHAIN_INFO and validation logic treats Solana as a non-EVM chain whose signed transaction does not start with 0x, expanding behavior beyond the stated hex-only scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.