T05 · Unauthorized Access and Privilege Escalation
Error
- Location
index.cjs:218- Finding
Reusable Bot Credentials Are Retrieved from Local Configuration and Disclosed to the Remote Backend
- Content
View full analysis
- Remediation
View remediation
Security audit
Crypto Listing Alert
Security checks for vulnerabilities and agentic risk
Overview
The skill broadly matches its stated subscription-alert purpose, but it handles reusable API and bot credentials in ways users should review carefully before installing.
Install only if you trust listingalert.org and are comfortable giving its backend your email or chat identifiers and, for Telegram/Discord delivery, full bot tokens. Prefer a dedicated bot token with minimal permissions, avoid custom API URLs unless you control them, do not use HTTP endpoints, and rotate any API key or bot token that may have been exposed in command history or logs.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
index.cjs:149- Finding
Unrestricted Custom API URL Permits Credential Exfiltration and Plaintext Transmission
- Content
View full analysis
--api-url --json ``` ``` `index.cjs:149-157`: ```js function handleLogin(args) { const apiKey = getArgValue(args, "--api-key"); const apiURL = getArgValue(args, "--api-url") || DEFAULT_API_URL; if (!apiKey) { process.stderr.write("Error: --api-key is required\n"); process.exit(1); } const cfg = { api_url: apiURL, api_key: apiKey }; ``` `index.cjs:601-635`: ```js function apiRequest(cfg, method, urlPath, body) { return new Promise((resolve, reject) => { // Ensure api_url ends with / for proper URL joining let baseUrl = cfg.api_url; if (!baseUrl.endsWith("/")) { baseUrl += "/"; } const fullURL = new URL(urlPath.replace(/^\//, ""), baseUrl); const mod = fullURL.protocol === "https:" ? https : http; const jsonData = body ? JSON.stringify(body) : null; const options = { method, hostname: fullURL.hostname, port: fullURL.port, path: fullURL.pathname + fullURL.search, headers: { "Content-Type": "application/json", }, timeout: 15000, }; if (cfg.api_key) { options.headers["X-API-Key"] = cfg.api_key; } if (jsonData) { options.headers["Content-Length"] = Buffer.byteLength(jsonData); } const req = mod.request(options, (res) => { ``` ### Technical Analysis The login command accepts an arbitrary `--api-url` and persists it without validating its scheme, hostname, or port. The request helper selects HTTPS only when the URL protocol is exactly `https:` and otherwise uses the Node.js HTTP module. Consequently, an `http://` endpoint is supported and receives the API key without ...[truncated 1887 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
index.cjs:149- Finding
API Keys and Bot Tokens Are Exposed Through Command-Line Arguments
- Content
View full analysis
--json ``` `SKILL.md:191-197`: ```bash node skills/crypto-listing-alert/index.cjs pay --plan --exchanges --billing --channel telegram --telegram --bot-token --json ``` ```bash node skills/crypto-listing-alert/index.cjs pay --plan --exchanges --billing --channel discord --discord-channel --bot-token --json ``` `index.cjs:149`: ```js const apiKey = getArgValue(args, "--api-key"); ``` `index.cjs:218-219`: ```js const telegramBotToken = getArgValue(args, "--bot-token"); const discordBotToken = getArgValue(args, "--bot-token"); ``` ### Technical Analysis The documented and implemented interface requires reusable secrets to be passed as command-line arguments. Process arguments are not an appropriate secret-transport mechanism because they can be captured by shell history, command execution records, agent tool logs, telemetry, debugging output, crash reports, or process-inspection facilities available to other local principals. The local configuration file is created with mode `0600`, which appropriately restricts the saved API key at rest, but that protection does not prevent exposure before the secret is written. The same issue applies every time a bot token is supplied to `pay` or `subscribe`. ### Attack Path 1. The user or agent follows the documented login, payment, or subscription command. 2. The API key or bot token is inserted directly into the command line. 3. The shell, agent runtime, orchestration layer, or telemetry system records the command. 4. Alternatively, another lo ...[truncated 855 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 60% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md --- name: crypto-listing-alert description: Use when users want to subscribe, pay, or manage Crypto Listing Alert notifications for exchange listing events and need Telegram, Discord, or Email delivery with API-key login. version: 1.0.2
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
text - If `logged_in = true`: proceed normally. - If `logged_in = false`: immediately guide user to get API key from website first, then login: 1. Visit `https://listingalert.org` 2. Register/login and generate API key
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill explicitly instructs the agent to read Telegram/Discord bot tokens and channel identifiers from local OpenClaw config, which expands its access to sensitive local secrets beyond what a subscription-management workflow minimally requires. If followed, this creates a secret-exfiltration and privilege-abuse path because the agent may retrieve credentials from the host environment and send them to the external CLI/backend during payment or subscription operations.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill says to pull data from message context and local config but does not clearly disclose that sensitive identifiers and tokens may be accessed and transmitted as part of the workflow. This lack of transparency increases the risk of unauthorized data use because users and operators are not properly warned that local secrets and contextual metadata are inputs to external actions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The login flow saves the provided API key to a file in the user's home directory and only reports 'Login successful. API key saved.' It does not clearly disclose that a credential is being persisted on disk at a specific path, which is a sensitive operation involving credential storage.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The code sends email addresses, Telegram chat IDs, Discord channel IDs, and bot tokens to the remote API as part of subscription creation. Although the command purpose implies remote interaction, there is no explicit warning in the code's user-facing text that these potentially sensitive values are transmitted to the service.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The payment flow posts email addresses, chat or channel identifiers, and bot tokens to the API endpoint to create an order. This is a network transmission of potentially sensitive data, but the user-facing help and runtime messages do not explicitly disclose that these values will be sent to the external service.
- Content