Crypto Threshold Watcher

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:55 AM UTC
• Version: 1.0.0

Overview

The skill describes useful crypto alerts, but it relies on an unbundled local script, an hourly recurring task, and automatic Telegram messages without enough scoping or verification.

Review or supply the actual threshold-watcher.js before using this skill, avoid enabling the hourly task until the script path is absolute and verified, and treat Telegram alerts as external sharing of trading watchlists, thresholds, notes, and signals. Do not connect exchange or messaging credentials unless the implementation is trusted and you know how to disable the recurring task.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

• Location: SKILL.md:73

Finding

Persistent Hourly Execution of an Unverified Trading Script

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 73-80
Vulnerability Type: Scheduled-task persistence
Risk Level: High

The skill instructs the user or agent to add a recurring task that executes a trading script every hour:

text

## Cron Integration

Add to TASKS.md cron:

text

Every 1h: node scripts/trading/threshold-watcher.js

text

Alerts delivered to Telegram DM automatically.

Technical Analysis

The recurring task survives the interaction in which the skill is invoked and repeatedly executes scripts/trading/threshold-watcher.js. The referenced script is not included in the audited project, so its implementation and integrity cannot be verified.

The scheduled command uses a relative path. Its resolved target can therefore depend on the scheduler's working directory and workspace state. If an attacker or another untrusted component can create or replace the referenced script, the scheduled task becomes a persistent arbitrary-code execution mechanism under the scheduler's account.

Automatic Telegram delivery also implies recurring external communication, but the artifact provides no destination validation, consent control, authentication handling, or data-flow implementation for review.

Attack Path

1. The skill is loaded and its cron integration instructions are followed.
2. An hourly task is written to TASKS.md.
3. An attacker or compromised workspace component creates or replaces scripts/trading/threshold-watcher.js.
4. At the next scheduled interval, the task invokes Node.js on the attacker-controlled file.
5. The file continues to execute every hour until the task is discovered and removed.

Impact Assessment

Successful exploitation permits recurring execution with the filesystem, process, environment-variable, and network privileges of the scheduled-task account. Depending on that account's permissions, attacker-controlled code could read ...[truncated 330 chars]

Remediation

View remediation

Remediation Suggestions

• Do not create recurring tasks automatically; require explicit, informed approval that identifies the command, interval, network activity, and removal procedure.
• Package the watcher implementation with the reviewed skill rather than relying on a mutable external workspace file.
• Invoke the script through a canonical absolute path and reject symlinks or unexpected ownership and permissions.
• Verify the script against a pinned cryptographic digest before each scheduled execution.
• Run the task under a dedicated least-privilege account or sandbox with narrowly scoped filesystem and network access.
• Restrict outbound traffic to documented API and notification endpoints.
• Validate the Telegram destination and require explicit authorization before enabling automatic messages.
• Record task creation in an audit log and provide an explicit command or documented procedure for disabling and removing it.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:38

Finding

Execution of an Unpackaged and Unverified External Script

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 38-51
Vulnerability Type: Unverified external executable reference
Risk Level: High

The documented usage commands invoke a Node.js file located outside the audited skill package:

bash

### Check all watchlist tokens
node ~/.openclaw/workspace/scripts/trading/threshold-watcher.js

### Add a token to watchlist
node ~/.openclaw/workspace/scripts/trading/threshold-watcher.js --add --symbol BTCUSDT --price-above 90000

### Check single token
node ~/.openclaw/workspace/scripts/trading/threshold-watcher.js --symbol ETHUSDT

Technical Analysis

The project contains only SKILL.md; it does not include threshold-watcher.js. The script's behavior, dependencies, argument handling, network destinations, credential access, notification logic, and integrity therefore cannot be audited.

The instructions trust a mutable file at a predictable workspace path. Any process or user capable of writing that file can determine what runs when the documented commands are used. The cron example elsewhere in the same file also uses the different relative path scripts/trading/threshold-watcher.js, creating additional ambiguity about which file is executed.

No remote download command, encoded payload, hardcoded secret, or embedded malicious script was present in the inspected artifact. The risk arises from delegating execution to an absent and unauthenticated implementation.

Attack Path

1. An attacker obtains write access to ~/.openclaw/workspace/scripts/trading/ or otherwise influences the file at the expected path.
2. The attacker places a malicious threshold-watcher.js at that location or replaces the legitimate file.
3. A user or agent follows one of the skill's documented usage commands.
4. Node.js executes the substituted file with the invoking account's privileges.
5. If cron integration is also enabled, the substituted implementation subsequent ...[truncated 583 chars]

Remediation

View remediation

Remediation Suggestions

• Include the complete watcher implementation and its dependency manifest in the audited package.
• Resolve the executable relative to an immutable package root rather than a general-purpose workspace directory.
• Verify file ownership, permissions, canonical path, and a pinned cryptographic digest before execution.
• Reject symlinks and fail closed when the expected implementation is missing or differs from the reviewed version.
• Pin dependency versions and integrity metadata, and review all transitive dependencies.
• Validate command-line arguments using strict schemas and avoid constructing shell commands from user-controlled values.
• Restrict outbound network access to explicitly approved Binance, CoinGecko, and notification endpoints.
• Execute the watcher in a least-privilege sandbox without unrelated credentials or filesystem access.
• Use one consistent canonical script path for interactive and scheduled invocation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

L086 states that alerts are delivered to Telegram DM automatically, yet the rest of the skill file only describes running a local threshold watcher script and does not document any Telegram setup, integration steps, or supporting behavior. This is an active intent mismatch in the documentation because it asserts a delivery mechanism beyond what the documented usage and scope establish.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Claiming automatic Telegram DM delivery without any warning about external transmission can lead users to expose trading signals, token watchlists, or strategy notes to a third-party messaging platform unexpectedly. In a trading context, even metadata about monitored assets and trigger conditions can be sensitive, so undocumented outbound delivery increases privacy and operational risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

L095-L096 claim support for rsi_above and rsi_below, but the manifest description in L003 and the example configuration in L020-L024 and L030-L033 only describe price and volume thresholds. This is a documentation contradiction because the file presents RSI checks as supported threshold types without any corresponding configuration example or usage flow showing that capability exists.

Content

No source excerpt is available for this finding.