Security audit

Ai Intelligent Blockchain Platform

Security checks for vulnerabilities and agentic risk

Overview

This skill advertises wallet and transaction features but tells users to run mutable, unreviewed remote Python code without clear security or privacy boundaries.

Review this before installing. Do not provide seed phrases, private keys, wallet files, or exchange/API credentials unless the remote repository and dependency set have been independently reviewed and pinned. Prefer running it in an isolated virtual environment or container with a low-privilege account and no unrelated secrets in the environment.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Warning

Location: SKILL.md:39
Finding: Mutable Remote Repository Retrieved and Executed Without Integrity Verification## Vulnerability Details **File Location**: `SKILL.md`, lines 39-42 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Medium **Complete Code Snippet**: ```bash git clone https://github.com/openclaw-skills/ai-intelligent-blockchain-platform cd ai-intelligent-blockchain-platform pip install -r requirements.txt python app.py ``` ### Technical Analysis The installation instructions direct users to clone a remote Git repository and execute its `app.py` file. The repository is not pinned to a specific commit hash or cryptographically verified release. The effective executable payload can therefore change after this Skill package has been reviewed. Neither `app.py` nor the referenced dependency manifest is included in the audited artifact, which contains only `SKILL.md` and `skill.json`. The behavior of the remotely retrieved application consequently cannot be established from the reviewed files. Although the documented commands do not themselves prove malicious intent, following them creates an unverified remote-code execution path. ### Attack Path 1. An attacker compromises the referenced repository, a maintainer account, or the repository’s distribution process. 2. The attacker modifies `app.py` or another imported module in the remote repository. 3. A user follows the installation instructions and clones the repository without selecting a trusted immutable revision. 4. The user runs `python app.py`. 5. The modified remote payload executes with the permissions and environment access of that user. ### Impact Assessment Successful exploitation could provide arbitrary code execution under the invoking user’s account. The payload could access files, environment variables, network resources, and credentials available to that account. Because the Skill advertises wallet-management and blockchain functionality, execution in an environment containing wallet credentials or private keys could have ...[truncated 122 chars]
Remediation: ## Remediation Suggestions - Include the reviewed application source within the Skill package rather than retrieving mutable code during installation. - If external retrieval is unavoidable, pin the repository to a specific trusted commit hash and verify the downloaded content against a published cryptographic digest. - Prefer signed releases and verify their signatures before execution. - Document the expected publisher identity and repository ownership so users can validate provenance. - Run the application with least privilege in an isolated virtual environment or container. - Prevent access to wallet secrets, private keys, and unrelated credentials until the retrieved code has been independently reviewed.

T08 · Insecure Dependencies

Warning

Location: SKILL.md:39
Finding: Unpinned and Unreviewed Python Dependencies Installed from External Sources## Vulnerability Details **File Location**: `SKILL.md`, lines 39-42 **Vulnerability Type**: Insecure third-party dependency installation **Risk Level**: Medium **Complete Code Snippet**: ```bash git clone https://github.com/openclaw-skills/ai-intelligent-blockchain-platform cd ai-intelligent-blockchain-platform pip install -r requirements.txt python app.py ``` ### Technical Analysis The instructions run `pip install -r requirements.txt`, but the referenced `requirements.txt` is not included in the audited artifact. Its package names, versions, indexes, hashes, and transitive dependencies therefore cannot be reviewed. The remote repository is also not pinned to an immutable revision, allowing its dependency manifest to change independently of this Skill. No requirement hashes, exact version constraints, trusted package-index restrictions, or lockfile verification are specified in the supplied files. This exposes installation to supply-chain risks such as a compromised dependency release, malicious dependency substitution, dependency confusion, or later modification of the remote manifest. ### Attack Path 1. An attacker compromises a dependency, publishes a malicious package selected by the manifest, abuses dependency resolution, or modifies the remote `requirements.txt`. 2. A user clones the mutable repository and runs the documented `pip install -r requirements.txt` command. 3. Pip resolves and downloads the attacker-controlled package or package version. 4. Malicious package installation logic may execute during installation, or malicious module code may execute when `app.py` imports it. 5. The package gains the permissions available to the Python or pip process. ### Impact Assessment A malicious dependency could execute code with the invoking user’s privileges during installation or application startup. Potential exposure includes local files, environment variables, developer credentials, network-accessible ser ...[truncated 241 chars]
Remediation: ## Remediation Suggestions - Bundle the reviewed dependency manifest with the Skill package. - Pin every direct dependency to an exact reviewed version and use a lockfile that captures transitive dependencies. - Record cryptographic hashes for all distributions and install with `pip install --require-hashes`. - Restrict package resolution to explicitly approved indexes and avoid untrusted extra indexes. - Generate a software bill of materials and scan dependencies for known vulnerabilities and suspicious package provenance. - Review package names for typosquatting and dependency-confusion exposure. - Install dependencies inside an isolated virtual environment or container using a non-privileged account. - Re-audit and update pins through a controlled process rather than allowing unconstrained dependency resolution.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The skill advertises wallet management, multi-chain support, and real-time transaction monitoring, which strongly implies handling sensitive financial and behavioral data. Without any warning about privacy, custody boundaries, key-handling practices, or transaction-monitoring implications, users may expose wallet information or misunderstand the security model, increasing risk of data leakage or unsafe operational use.

Natural-Language Policy Violations

Low

Confidence: 72% confidence
Finding: The natural-language content in the description and documentation is entirely Chinese, and the file does not indicate that the skill is explicitly intended only for Chinese-speaking users or provide an alternative language option. Under the language/locale policy, forcing a specific language without opt-in can be a policy concern.

Static analysis

No suspicious patterns detected.