ClawHub
Back to skill

Security audit

Find Crypto Skills

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent crypto-skill finder, but it recommends installing remote trading-related code globally and non-interactively without pinning or strong review safeguards.

Review this skill carefully before installing. Prefer pinned versions, local or sandboxed installation, explicit confirmation, and source review before adding any crypto or trading skill. Do not run it on a machine or account that holds wallet seed phrases, withdrawal-capable exchange keys, or production trading credentials.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:90
Finding

Unpinned Third-Party Skill Installation with Unattended Global Scope

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 90-94; related CLI instructions at lines 22-28 and 51-53
Vulnerability Type: Untrusted and unpinned dependency installation
Risk Level: High

Vulnerable Code

bash
npx skills add <owner/repo@skill> -g -y

Related commands include:

bash
npx skills find [query]
npx skills add <package>
npx skills check
npx skills update

Technical Analysis

The skill directs the agent to discover and install third-party cryptocurrency skills using an npm-distributed CLI. Neither the skills CLI nor the discovered skill is pinned to a reviewed immutable version, commit hash, or integrity digest.

Invoking npx skills can retrieve and execute a package version from an external package registry. The resulting payload can therefore differ from the version previously reviewed. The discovered skill is likewise installed from a mutable package or repository reference without a mandatory source review or integrity check.

The -g option increases the installation scope by installing the selected skill globally, while -y suppresses the normal confirmation checkpoint. Together, these options facilitate unattended installation of remotely sourced code and reduce the user's opportunity to inspect the selected source, requested privileges, lifecycle scripts, and package contents.

The document advises users to verify skill sources, but verification is only a reminder and is not enforced before installation.

Attack Path

  1. An attacker publishes a malicious skill under a plausible name, compromises an existing skill or CLI package, or introduces malicious content into a mutable repository reference.
  2. The agent searches the ecosystem using npx skills find and presents the attacker-controlled package as a relevant result.
  3. The user accepts the installation based on the skill name or search result.
  4. The agent runs `npx skills add ...[truncated 1134 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin the skills CLI to a reviewed version instead of executing an unspecified current release, for example by using an exact package version.
  2. Pin every installed skill to an immutable release, verified commit hash, or equivalent immutable identifier.
  3. Verify registry integrity metadata, repository ownership, release signatures, and cryptographic checksums before installation.
  4. Remove -g and install skills into an isolated project or sandbox with the minimum necessary filesystem and network permissions.
  5. Remove -y and require explicit, informed user approval after displaying the exact package, version, source repository, requested permissions, and installation scripts.
  6. Inspect package manifests, lifecycle hooks, scripts, dependencies, and source code before execution.
  7. Disable or ignore package lifecycle scripts where supported unless they have been separately reviewed and are required.
  8. Use exchange API keys restricted to the minimum required operations, prohibit withdrawal permissions, and isolate credentials per skill.
  9. Test newly installed crypto skills with non-sensitive accounts and small amounts before allowing access to production trading systems.
  10. Establish an allowlist of reviewed publishers and packages rather than installing arbitrary search results.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (22)

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The skill repeatedly instructs use of npx skills without pinning a specific package version, which causes execution of whatever package version is current at install time. Because npx may fetch and execute remote code, a compromised or malicious package update could lead to arbitrary code execution on the user's system.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This reference to npx skills is unpinned, so the skill encourages execution of a mutable remote package rather than a known reviewed version. In a crypto-related context, users may run these commands on systems that also hold exchange API credentials or wallet tooling, increasing the blast radius of a supply-chain compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

An unpinned npx skills add <package> command exposes users to supply-chain risk because the resolver may execute the latest package manager code and then install third-party code without a stable trust boundary. If the package manager or registry entry is hijacked, arbitrary code could run during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

This unpinned npx skills check example still relies on executing mutable remote package code. Even non-install commands can execute attacker-controlled logic if the package source is compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The npx skills update command is especially risky when unpinned because it both executes mutable package manager code and updates installed skills, potentially pulling in additional unreviewed changes. This compounds supply-chain exposure by widening the set of code that may change at runtime.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The search command example uses unpinned npx skills, so users are instructed to execute whatever package version is currently published. Since npx can download and run code immediately, this creates a supply-chain execution path with no version stability.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This line recommends an unpinned search command in a crypto-trading workflow, where users may be more likely to trust and execute commands quickly. That makes the lack of version pinning more dangerous because the surrounding use case involves financial tooling and potentially sensitive credentials.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The skill suggests another unpinned npx skills find ... command, again allowing execution of mutable remote code. An attacker who compromises the package or publishing account could use this trust path to execute arbitrary scripts on user machines.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This search example is a true supply-chain risk because it normalizes repeated execution of an unpinned remote package. Frequent command repetition can desensitize users to the fact that they are executing code, not merely querying a static registry.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The unpinned command creates an avoidable trust-on-first-use problem. In the crypto context, compromise of the CLI could lead to credential theft, wallet targeting, or malicious dependency installation under the guise of skill discovery.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

By recommending npx skills find onchain analytics without a pinned version, the skill exposes users to arbitrary code execution from a mutable package source. The command appears harmless, but it still executes code with user privileges.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This command example repeats the same unpinned package execution pattern, which is a genuine security issue rather than just documentation style. The risk is amplified because users seeking token-swap automation may later install or connect higher-risk tooling based on the search results.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The line instructs execution of an unpinned remote CLI in a finance-related scenario, so it remains a real supply-chain vulnerability. If the package or its dependencies are compromised, the host may be exposed before the user even reviews any found skills.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

Another unpinned npx skills find ... example encourages execution of changing remote code. Because the skill is framed as a trusted assistant workflow, users may infer a safety guarantee that does not actually exist.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This example normalizes unpinned package execution in a context involving wallet monitoring and blockchain analysis tools, which may coexist with sensitive operational environments. That makes compromise potentially more severe than in a generic productivity context.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The command for finding trading bots is unpinned and therefore inherits the same remote code execution and supply-chain risk. In this specific context, an attacker could target users interested in automation, who may later grant API access to installed tools.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The example install command npx skills add okx-trade is a true vulnerability because it both executes an unpinned package manager and installs a named third-party trading skill. In a crypto setting, this can quickly bridge from documentation to execution of code that may request exchange credentials or perform account actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill recommends npx skills add <owner/repo@skill> -g -y, which executes and globally installs third-party code non-interactively, but it does not adequately warn about the security implications of doing so. In a crypto-trading context, this is especially dangerous because users may install software that later handles exchange API keys or influences financial actions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
98% confidence
Finding

The command npx skills add <owner/repo@skill> -g -y is especially dangerous because it combines unpinned execution with global, non-interactive installation. This removes friction and can lead to silent installation of unreviewed code system-wide, increasing persistence and impact if the package is malicious.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill is described as a finder/installer for crypto-related skills, but it expands into directly helping with crypto actions when no skill is found. This scope drift can bypass governance boundaries, causing the agent to provide higher-risk financial or on-chain assistance that the user and system may not expect from a discovery-only skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The documentation tells the agent to directly fetch price data, analyze wallets, or explain DeFi protocols, which goes beyond its declared purpose of finding/installing skills. In a crypto context, hidden expansion of capability increases the chance of unsanctioned financial guidance, privacy issues around wallet analysis, or interaction patterns not covered by the skill's trust model.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The scaffolding example again uses unpinned npx skills, exposing users to mutable package execution even for skill creation. Although lower risk than direct install, it still creates an avoidable arbitrary-code-execution path from remote package resolution.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.