ClawHub
Back to skill

Security audit

Crypto News

Security checks for vulnerabilities and agentic risk

Overview

This skill fetches BlockBeats news through a disclosed API key and does not show hidden persistence, local data access, or unrelated behavior.

Install only if you are comfortable providing a BlockBeats API key to this skill and allowing it to contact the BlockBeats API. The skill is Chinese-language focused and should be treated as an authenticated news-fetching helper, not a general research tool.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The public description says the skill retrieves BlockBeats news, but the implementation details reveal authenticated API usage via BLOCKBEATS_API_KEY and additional filtering/pagination behavior that is not transparently declared. This mismatch is dangerous because reviewers and users may underestimate the sensitivity of required credentials and the scope of external interactions, leading to unsafe approval or deployment of the skill.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · index.js (reported line 7)May include surrounding context.

js
// 2. 强制拦截：如果没有配置 Key，直接报错并退出
if (!apiKey) {
    console.error("❌ 缺少凭证: 无法获取快讯。请务必先在 OpenClaw 的环境变量或 .env 文件中配置 BLOCKBEATS_API_KEY。");
    process.exit(1); // 抛出异常退出码，让 AI 知道脚本执行失败了
}

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill declares executable behavior that uses environment variables and external network access, but it does not define any explicit tool scope such as permissions or allowed-tools. This is dangerous because consumers of the skill cannot accurately constrain what the skill may access, increasing the chance of unintended secret exposure or unauthorized outbound requests during execution.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill’s description and usage instructions are entirely in Chinese, indicating a language-specific interaction model. Under the policy, forcing a specific language without user opt-in or a documented justification is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This file uses Chinese-only comments and runtime error/output strings, including the credential error and no-data message, without offering a language choice or documenting that the skill is intentionally China/Chinese-locale specific. That creates a natural-language policy issue because the skill effectively forces a locale on users without opt-in.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · index.js (reported line 16)May include surrounding context.

js
const page = process.env.NEWS_PAGE || '1';
const type = process.env.NEWS_TYPE || '';

const url = `https://api.theblockbeats.news/v1/open-api/open-flash?size=${size}&page=${page}&type=${type}`;

// 4. 发起真实请求
fetch(url, {

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
index.js:3