Security audit

Crypto Funding Monitor

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but it ships a live-looking payment API key and exposes unauthenticated payment and subscription controls that could be abused.

Do not install or publish this skill as-is. Treat the embedded SkillPay key as compromised, rotate it, replace all examples with placeholders, add authentication and webhook verification before enabling payments or subscriptions, restrict CORS, and sanitize all scraped content before sending notifications.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: skill.json:15
Finding: Hardcoded SkillPay API Key Published in Project Files
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: src/index.js:169
Finding: Unsigned Payment Callback Allows Payment Bypass
Content: View full analysis
{ try { const { userId, paymentId, status } = req.body; if (status === 'completed') { const subscription = this.subscriptions.get(userId); if (subscription && subscription.paymentId === paymentId) { subscription.status = 'active'; this.subscriptions.set(userId, subscription); } } res.json({ success: true }); } catch (error) { console.error('Payment callback error:', error); res.status(500).json({ error: error.message }); } }); ``` ### Technical Analysis The payment callback trusts the caller-supplied `status`, `userId`, and `paymentId` without authenticating the callback source. It does not verify: - A provider-generated cryptographic signature. - A shared webhook secret. - The source identity of the request. - Event freshness or replay status. - The payment amount or currency. - The payment state through a server-to-server SkillPay query. The `/subscribe` endpoint returns the newly created payment information to the caller, including the `paymentId`. A caller can therefore obtain the identifier required by the callback and then claim that the payment was completed. Matching a caller-supplied payment ID against the in-memory subscription does not prove payment because that same identifier was disclosed to the caller during subscription creation. ### Attack Path 1. The attacker submits a request to `POST /subscribe` with an attacker-selected `userId` and notification channels. 2. The endpoint creates a pending subscription and returns a payment response containing its `paymentId`. 3. The attacker does not complete the payment. 4. The attacker submits the following type of request to `POST /payment/callback`: ...[truncated 966 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: src/index.js:135
Finding: Unauthenticated Subscription Endpoints Permit IDOR, Disclosure, and Deletion
Content: View full analysis
{ res.header('Access-Control-Allow-Origin', '*'); res.header('Access-Control-Allow-Headers', 'Origin, X-Requested-With, Content-Type, Accept, Authorization'); next(); }); ``` Subscription deletion and retrieval depend solely on a caller-supplied user ID: ```js // 取消订阅 this.app.post('/unsubscribe', async (req, res) => { try { const { userId } = req.body; if (!userId) { return res.status(400).json({ error: 'Missing userId' }); } this.subscriptions.delete(userId); res.json({ success: true, message: 'Subscription cancelled' }); } catch (error) { console.error('Unsubscribe endpoint error:', error); res.status(500).json({ error: error.message }); } }); // 获取订阅状态 this.app.get('/subscription/:userId', (req, res) => { const { userId } = req.params; const subscription = this.subscriptions.get(userId); if (!subscription) { return res.status(404).json({ error: 'Subscription not found' }); } res.json({ success: true, subscription }); }); ``` ### Technical Analysis The application has no authentication middleware and performs no ownership or authorization check before reading or deleting a subscription. Knowledge or successful guessing of a `userId` is treated as sufficient authority. The status endpoint returns the complete subscription object. Based on the object created by `/subscribe`, this includes: - Notification channel configuration. - Telegram chat IDs or email destinations when configured. - Schedule information. - Subscription status. - Payment ID. The wildcard CORS policy permits browser scripts hosted on arbitrary origins to read responses where no other brow ...[truncated 1185 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: src/notifiers/email.js:83
Finding: Untrusted Scraped Data Is Embedded into HTML and Markdown Notifications Without Sanitization
Content: View full analysis
{ html += `

${project.projectName}

融资金额: ${project.amount}

融资轮次: ${project.round}

投资方: ${project.investors}

类别: ${project.category}

简介: ${project.description}

查看详情 →

`; }); ``` The TGE fields are handled in the same way: ```js tegData.slice(0, 5).forEach(project => { html += `

${project.projectName} (${project.tokenSymbol})

TEG日期: ${project.tgeDate}

初始价格: ${project.initialPrice}

总供应量: ${project.totalSupply}

类别: ${project.category}

简介: ${project.description}

查看详情 →

`; }); ``` Discord Markdown embeds are also constructed without escaping: ```js const fundingFields = fundingData.slice(0, 5).map(project = ...[truncated 2709 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (84)

Missing User Warnings

Critical

Category: Not specified by scanner
Confidence: 100% confidence
Finding: A full API key is included in plaintext in the documentation with no warning or masking. This is a straightforward secret leak and is especially dangerous because the skill is designed to process paid transactions, making credential abuse immediately valuable.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · PROJECT_STRUCTURE.md (reported line 18)May include surrounding context.
md
│ └── email.js # Email推送 ├── package.json # 项目依赖配置 ├── skill.json # Clawhub skill配置 ├── .env # 环境变量（已配置SkillPay API Key） ├── .env.example # 环境变量示例 ├── .gitignore # Git忽略文件 ├── README.md # 项目说明

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · QUICKSTART.md (reported line 19)May include surrounding context.
md
│ └── email.js # Email推送 ├── package.json # 项目依赖配置 ├── skill.json # Clawhub skill配置 ├── .env # 环境变量（已配置SkillPay API Key） ├── .env.example # 环境变量示例 ├── .gitignore # Git忽略文件 ├── README.md # 项目说明

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · QUICKSTART.md (reported line 54)May include surrounding context.
md
│ └── email.js # Email推送 ├── package.json # 项目依赖配置 ├── skill.json # Clawhub skill配置 ├── .env # 环境变量（已配置SkillPay API Key） ├── .env.example # 环境变量示例 ├── .gitignore # Git忽略文件 ├── README.md # 项目说明

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · START_HERE.txt (reported line 70)May include surrounding context.
text
│ └── email.js # Email推送 ├── package.json # 项目依赖配置 ├── skill.json # Clawhub skill配置 ├── .env # 环境变量（已配置SkillPay API Key） ├── .env.example # 环境变量示例 ├── .gitignore # Git忽略文件 ├── README.md # 项目说明

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · quickstart.sh (reported line 39)May include surrounding context.
sh
│ └── email.js # Email推送 ├── package.json # 项目依赖配置 ├── skill.json # Clawhub skill配置 ├── .env # 环境变量（已配置SkillPay API Key） ├── .env.example # 环境变量示例 ├── .gitignore # Git忽略文件 ├── README.md # 项目说明

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · quickstart.sh (reported line 40)May include surrounding context.
sh
│ └── email.js # Email推送 ├── package.json # 项目依赖配置 ├── skill.json # Clawhub skill配置 ├── .env # 环境变量（已配置SkillPay API Key） ├── .env.example # 环境变量示例 ├── .gitignore # Git忽略文件 ├── README.md # 项目说明

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · quickstart.sh (reported line 41)May include surrounding context.
sh
│ └── email.js # Email推送 ├── package.json # 项目依赖配置 ├── skill.json # Clawhub skill配置 ├── .env # 环境变量（已配置SkillPay API Key） ├── .env.example # 环境变量示例 ├── .gitignore # Git忽略文件 ├── README.md # 项目说明

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · quickstart.sh (reported line 42)May include surrounding context.
sh
│ └── email.js # Email推送 ├── package.json # 项目依赖配置 ├── skill.json # Clawhub skill配置 ├── .env # 环境变量（已配置SkillPay API Key） ├── .env.example # 环境变量示例 ├── .gitignore # Git忽略文件 ├── README.md # 项目说明

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · quickstart.sh (reported line 43)May include surrounding context.
sh
│ └── email.js # Email推送 ├── package.json # 项目依赖配置 ├── skill.json # Clawhub skill配置 ├── .env # 环境变量（已配置SkillPay API Key） ├── .env.example # 环境变量示例 ├── .gitignore # Git忽略文件 ├── README.md # 项目说明

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · quickstart.sh (reported line 66)May include surrounding context.
sh
│ └── email.js # Email推送 ├── package.json # 项目依赖配置 ├── skill.json # Clawhub skill配置 ├── .env # 环境变量（已配置SkillPay API Key） ├── .env.example # 环境变量示例 ├── .gitignore # Git忽略文件 ├── README.md # 项目说明

Credential Access

High

Category: Privilege Escalation
Confidence: 93% confidence
Finding: The summary explicitly states that a .env file with an already configured API key is part of the project. Shipping or encouraging distribution of pre-populated credential files is dangerous because .env files are commonly committed, copied, or deployed insecurely, which can lead to credential theft, unauthorized API usage, billing abuse, and compromise of connected services.
Content: Scanner excerpt · PROJECT_SUMMARY.md (reported line 35)May include surrounding context.
md
│ └── email.js # ✅ Email 推送 ├── package.json # ✅ 依赖配置 ├── skill.json # ✅ Clawhub 配置 ├── .env # ✅ 环境变量（已配置 API Key） ├── test.js # ✅ 测试脚本 ├── quickstart.sh # ✅ 快速启动脚本 └── 文档/

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation explicitly states that a SkillPay API key is already configured and encourages immediate use of paid functionality. Even though the concrete key appears later, this guidance normalizes using embedded credentials and can lead users to unknowingly consume someone else's billing quota or a leaked shared secret.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The quickstart endorses using a preconfigured paid API key without any security, ownership, or billing warning. In a monetized skill context, that creates real risk of unauthorized paid usage and trains users to accept embedded secrets as normal deployment practice.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 100% confidence
Finding: This section presents required configuration as already completed while exposing a full live-looking API key in plaintext. Publishing a secret in documentation is a direct credential disclosure that can enable unauthorized API use, billing abuse, service impersonation, and downstream account compromise.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README instructs users to supply multiple sensitive credentials, including bot tokens, webhook URLs, email passwords, and API keys, without guidance on secure storage, least privilege, or handling of personal data. While configuration itself is expected, the lack of security warnings increases the chance of unsafe deployment, credential leakage, or misuse of third-party accounts.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The README includes what appears to be an actual SkillPay API key rather than a placeholder, which can enable unauthorized use of the payment integration if the key is valid. Publishing secrets in documentation is especially dangerous because they are easy to scrape, reuse, and persist in git history even after later removal.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · USAGE.md (reported line 16)May include surrounding context.
复制 .env.example 到 .env 并填写配置：

bash
cp .env.example .env

编辑 .env 文件：

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The documentation contains a live-looking SkillPay API key embedded directly in the example .env file. Publishing what appears to be a real secret can enable unauthorized API use, billing abuse, account compromise, or downstream access depending on the key's privileges.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: A real-looking API key is shown inline without any warning that it must be replaced and protected. Readers may mistakenly reuse the exposed key or normalize unsafe secret-handling practices, increasing the likelihood of credential leakage and unauthorized service consumption.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: undici==6.21.3 — 13 advisory(ies): CVE-2026-1525 (Undici has an HTTP Request/Response Smuggling issue); CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-1527 (Undici has CRLF Injection in undici via `upgrade` option) +10 more

High

Category: Supply Chain
Confidence: 90% confidence
Finding: The lockfile pins undici 6.21.3, and the static analysis indicates multiple high-severity advisories affecting that exact version, including request/response smuggling and header injection classes of bugs. In a skill that performs outbound HTTP interactions and bot/API communications, a vulnerable HTTP client library can materially increase risk of SSRF-adjacent abuse, response confusion, or protocol-level attacks.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

Category: Supply Chain
Confidence: 91% confidence
Finding: Axios 1.13.6 is flagged with multiple advisories, including SSRF-related proxy bypass and prototype-pollution-related impacts. Because this skill appears to monitor external crypto/web sources, it likely makes network requests to potentially variable endpoints, which makes HTTP client flaws more relevant than they would be in a purely local tool.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==5.0.4 — 5 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-45149 (brace-expansion: Large numeric range defeats documented `max` DoS protection) +2 more

High

Category: Supply Chain
Confidence: 80% confidence
Finding: brace-expansion 5.0.4 is associated with several DoS-style issues, but here it appears in a dev dependency path related to tooling rather than runtime application logic. That makes the finding real at the package level but less dangerous in deployed skill execution unless untrusted patterns are processed during build or development automation.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

Category: Supply Chain
Confidence: 86% confidence
Finding: form-data 4.0.5 is reported as vulnerable to CRLF injection through unescaped multipart names/filenames. If the skill constructs multipart requests using untrusted metadata, an attacker may be able to manipulate outbound request structure or smuggle unintended headers/body parts.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: lodash==4.17.23 — 2 advisory(ies): CVE-2025-13465 (lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and ); CVE-2021-23337 (lodash vulnerable to Code Injection via `_.template` imports key names)

High

Category: Supply Chain
Confidence: 80% confidence
Finding: lodash 4.17.23 is flagged for prototype pollution and template-related code injection concerns. Whether exploitation is practical depends on the application code paths, but in a bot/monitoring skill that may transform external JSON or config-like data, prototype pollution can become a useful exploitation primitive.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.