ClawHub
Back to skill

Security audit

Fear Greed Index

Security checks for vulnerabilities and agentic risk

Overview

This skill reports crypto sentiment as described, but it automatically performs paid SkillPay billing and handles a payment API key for a simple market report, so it needs review before installation.

Install only if you are comfortable with each invocation creating a 0.001 USDT SkillPay billing request. Prefer using a protected environment variable for SKILLPAY_API_KEY, avoid passing the key on the command line, and require explicit user approval before an agent runs either script.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/index.py:159
Finding

SkillPay API Key Exposed Through Command-Line Arguments in Index Script

Content
View full analysis
`. 2. The complete command is retained in shell history, captured in automation logs, or temporarily exposed through process inspection. 3. An attacker with access to the same system, logs, or monitoring data retrieves the key. 4. The attacker attempts to reuse the credential against the SkillPay API. 5. If the credential grants billing authority and no additional controls prevent misuse, unauthorized billing requests may be submitted. This path requires access to process arguments, command history, or associated logs; the code does not independently transmit the key to an undeclared endpoint. ### Impact Assessment Successful exploitation could disclose the SkillPay API credential and permit operations authorized to that key, potentially including unauthorized billing requests. The precise scope is limited by the server-side permissions, account controls, rate limits, and revocation policy assigned to the cr ...[truncated 211 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/history.py:89
Finding

SkillPay API Key Exposed Through Command-Line Arguments in History Script

Content
View full analysis
`. 2. Shell history, process-monitoring infrastructure, or job logs record or expose the argument. 3. An attacker who can read that information obtains the API key. 4. The attacker attempts to authenticate to SkillPay using the recovered credential. 5. Subject to the key's server-side authorization, the attacker may issue unauthorized billing requests. The attacker must first have access to local process information, history, or logs. No hidden exfiltration channel was identified in the reviewed project. ### Impact Assessment The exposed key could allow unauthorized use of the SkillPay account within the credential's assigned permissions. Potential consequences include fraudulent charges, financial loss, service abuse, and credential revocation. The exact impact depends on SkillPay's authorization model, rate limits, transaction co ...[truncated 296 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (15)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Requiring a user ID for charging and contacting an unrelated payment service is materially different from the stated reporting-only use case. In this context, the mismatch is more dangerous because a low-risk informational skill would not normally need payment-linked identifiers, so users may disclose data or incur charges they do not reasonably expect.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Requiring a user ID for charging and contacting an unrelated payment service is materially different from the stated reporting-only use case. In this context, the mismatch is more dangerous because a low-risk informational skill would not normally need payment-linked identifiers, so users may disclose data or incur charges they do not reasonably expect.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill includes billing functionality unrelated to merely reporting market sentiment, and it transmits a user identifier plus a billing request to a third-party payment service. In this skill context, adding paid charging behavior materially expands trust and abuse risk because a simple information lookup can trigger financial operations.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill advertises executable commands and appears to require network and environment access, but it does not declare any tool scope or permissions. This creates a transparency and least-privilege problem: reviewers and users cannot accurately assess what capabilities the skill will use, increasing the chance of unintended data access or outbound requests.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script performs third-party billing through SkillPay even though the skill is described as a simple fear/greed index reporter. This creates an undisclosed financial side effect and transmits user identifiers plus billing metadata to an external payment service, which is materially more sensitive than the stated functionality and can lead to unexpected charges.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code reads a billing API key from the environment to authorize payment operations unrelated to the core sentiment-reporting purpose. While environment-variable use is common, here it enables hidden financial actions and expands the blast radius if the skill is misused or invoked unexpectedly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script charges the user before fetching data and does so automatically upon execution, without any explicit in-flow confirmation step. This is dangerous because a user requesting innocuous market information could incur a charge merely by invoking the skill, enabling deceptive or unauthorized monetization.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The code reads a billing API key from the environment in a skill whose stated purpose is only market-sentiment reporting. Accessing sensitive billing credentials increases the blast radius of the skill and creates unnecessary exposure if the skill is misused, modified, or run in a broader agent environment.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/history.py (reported line 54)May include surrounding context.

python
def get_fear_greed():
    """获取加密货币恐惧贪婪指数"""
    url = "https://api.alternative.me/fng/?limit=2"
    req = urllib.request.Request(url, headers={'User-Agent': 'Mozilla/5.0'})
    
    with urllib.request.urlopen(req, timeout=10) as r:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/index.py (reported line 54)May include surrounding context.

python
def get_fear_greed():
    """获取加密货币恐惧贪婪指数"""
    url = "https://api.alternative.me/fng/?limit=2"
    req = urllib.request.Request(url, headers={'User-Agent': 'Mozilla/5.0'})
    
    with urllib.request.urlopen(req, timeout=10) as r:

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/index.py (reported line 73)May include surrounding context.

python
def get_fear_greed():
    """获取加密货币恐惧贪婪指数"""
    url = "https://api.alternative.me/fng/?limit=2"
    req = urllib.request.Request(url, headers={'User-Agent': 'Mozilla/5.0'})
    
    with urllib.request.urlopen(req, timeout=10) as r:

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The main execution path forces a charge before any data retrieval, so users cannot use the reporter without first invoking a financial transaction. That mismatch between the skill description and runtime behavior makes the skill more dangerous because it can surprise users with billing for a low-risk informational request.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill initiates a billing network call before presenting any user-facing warning or confirmation, which can lead to unauthorized or unexpected charges. In the context of a simple crypto index reporter, silent charging is especially risky because users would not reasonably expect a transactional side effect from a read-only query.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The manifest emphasizes fetching the current market sentiment index and providing a daily market emotion update. The code instead retrieves up to an arbitrary number of historical days and formats a 30-day history view, which is a broader behavior than the stated current-status reporting.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

User-facing strings, help text, and descriptive comments are written in Chinese throughout the file, with no option to select another language. Under the stated policy, forcing a specific language without opt-in is a natural-language policy violation unless clearly documented and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.