Security audit

4Claw Mint

Security checks for vulnerabilities and agentic risk

Overview

This skill performs the advertised token minting flow, but it uses raw wallet keys and remote signing in ways that can expose users to unauthorized or misdirected blockchain transactions.

Review carefully before installing or running. Do not paste a funded wallet private key into the documented command. Treat the signer URL as security-critical, prefer HTTPS and a pinned expected contract address, and do not operate the signer service publicly without authentication, durable rate limits, and body-size limits.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: scripts/server.js:33
Finding: Unauthenticated Mint Authorization Service
Content: View full analysis
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Error

Location: scripts/mint.js:10
Finding: Untrusted Plaintext Signer Response Controls the Transaction Destination
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/mint.js:4
Finding: Wallet Private Key Exposed Through Command-Line Arguments
Content: View full analysis
// Example: node mint.js 0xYOUR_PRIVATE_KEY http://43.160.201.224:3456 const { ethers } = require("ethers"); const https = require("https"); const http = require("http"); const PRIVATE_KEY = process.argv[2]; ``` The same insecure invocation method is documented in `SKILL.md:31-38`: ```bash node scripts/mint.js ``` ### Technical Analysis The script accepts a wallet private key as a positional command-line argument. Command-line arguments may be observable through process inspection facilities, automation telemetry, diagnostic tools, terminal scrollback, shell command history, job definitions, or logs produced by wrappers and orchestration systems. A wallet private key is a bearer credential that grants the holder full signing authority. Unlike a password, it generally cannot be rotated without moving the wallet's assets and changing the wallet address. Passing it through `argv` unnecessarily expands the number of local components that may capture it. ### Attack Path 1. A user follows the documented command and includes the raw wallet private key in the shell command. 2. The command is retained in shell history, captured by a process monitor, or recorded by an automation or logging layer. 3. A local attacker or another party with access to those records retrieves the key. 4. The attacker imports the key into a wallet and signs arbitrary transactions as the victim. 5. The attacker transfers assets or otherwise exercises all privileges associated with that wallet. ### Impact Assessment Disclosure results in complete compromise of the affected wallet. An attacker can sign arbitrary transactions, transfer native currency and tokens, interact with con ...[truncated 239 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/server.js:25
Finding: Unbounded HTTP Request Body Enables Denial of Service
Content: View full analysis
{ let body = ""; req.on("data", c => body += c); req.on("end", () => { try { resolve(JSON.parse(body)); } catch(e) { reject(e); } }); }); } ``` ### Technical Analysis The HTTP server concatenates every received request-body chunk into an in-memory string without enforcing a maximum size. It also does not establish an application-level body timeout in this function. Because `/api/mint-signature` is publicly reachable and does not require authentication, an attacker can submit oversized bodies or maintain slow uploads. Repeated string concatenation and subsequent JSON parsing consume memory and event-loop time. Multiple concurrent requests can amplify resource usage and may cause garbage-collection pressure, severe latency, or process termination from memory exhaustion. ### Attack Path 1. An attacker opens one or more connections to `POST /api/mint-signature`. 2. The attacker sends a very large body, or continuously streams body data without completing the request. 3. The server appends all received data to the `body` string without checking its size. 4. Concurrent malicious requests consume increasing memory and connection resources. 5. The signer service becomes slow, unavailable, or crashes, preventing legitimate mint-authorization requests. ### Impact Assessment A remote unauthenticated attacker can degrade or deny availability of the signer service. The primary scope is the Node.js process and the mint-signature API; resource exhaustion may also affect other workloads sharing the same host or container. This issue does not by itself provide code execution or signer-key disclosure. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The documented purpose presents the skill as a simple mint/status/info utility, but the behavior includes handling raw private keys, initiating blockchain transactions, and contacting an external signing service. That mismatch is dangerous because users and orchestrators may approve or route the skill under false assumptions, leading to credential disclosure, unexpected fund movement, or unreviewed outbound network communication.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script takes a raw private key as a command-line argument, which commonly exposes secrets through shell history, process listings, job logs, orchestration metadata, and monitoring tools. In an agent skill that mints on behalf of users, this is especially dangerous because compromise of the private key gives full control of the wallet and any assets it holds, far beyond this single mint operation.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill describes behavior that relies on sensitive capabilities such as environment access and operational secrets, but it declares no explicit tool scope or permissions. This creates an authorization transparency gap: a caller or platform may not realize the skill can access secrets or perform privileged actions, increasing the chance of unintended secret exposure or unauthorized execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The instructions explicitly tell operators to pass a raw wallet private key and configure a signer private key, but provide no warning about the sensitivity of those credentials or safer handling methods. In this context, the risk is elevated because the skill also directs use of an external IP-based signer service; compromise, logging, shell history leakage, or operator error could expose keys that control wallets or the mint authorization service.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script allows an arbitrary server_url argument and then POSTs the wallet address to ${SERVER_URL}/api/mint-signature, trusting the returned contract, nonce, deadline, and signature. In this skill context, that is more dangerous than a generic outbound request because the remote server directly influences which on-chain contract the agent signs and pays gas to interact with, enabling phishing, transaction redirection, and unwanted network egress to attacker-controlled hosts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This code reads a signing private key from the SIGNER_PRIVATE_KEY environment variable and immediately uses it to create a wallet, but there is no comment, docstring, or user-facing disclosure explaining that the service depends on sensitive credential material. For code files, access to sensitive environment variables should have at least some visible warning or explanation unless clearly documented elsewhere in the skill description, which is not present in this file.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest describes a skill used to mint 4Claw tokens on BSC, which implies carrying out or directly initiating the mint action. In this file, the main operation is generating and returning an off-chain signature plus metadata; no blockchain transaction is submitted and no mint function is invoked, so the implemented behavior is materially narrower and different from the claimed minting behavior.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The public status endpoint discloses the signer address, contract address, chain ID, and cooldown policy to any caller. While none of these are secret individually, exposing signer identity and operational details makes targeted abuse, reconnaissance, and service fingerprinting easier for attackers against a mint-signing service.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.