ClawHub
Back to skill

Security audit

Moltrade 1.0.9

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly aligned with a trading-bot purpose, but it asks for high-impact trading and posting authority with unsafe install and credential-handling guidance that users should review carefully.

Only install or use this skill in an isolated environment after reviewing the upstream repository and pinning dependencies. Use testnet or dry-run modes first, never paste wallet private keys or API secrets into chat, prefer environment variables or a real secret manager, restrict API permissions, and require explicit confirmation before any live trade or public Binance Square post.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Error
Location
SKILL.md:52
Finding

Unpinned Remote Repository and Third-Party Dependency Installation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:176
Finding

Wallet and API Secrets May Be Disclosed Through Plaintext Configuration or Chat

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill description is overly broad and grants wide latitude to 'operate' a trading bot without clearly defining allowed actions, required confirmations, or excluded sensitive operations. In an agent environment, this can cause the skill to activate for general trading-related requests and perform high-risk actions such as config changes, signal broadcasting, or even progression toward live trading with insufficient user intent verification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The marketing-style phrase 'YOUR 24/7 AI TRADER ! EARNING MONEY WHILE YOU'RE SLEEPING.' encourages broad interpretation of the skill's purpose and may bias an agent toward autonomous trading behavior beyond a user's precise request. In the context of a financial trading skill, ambiguous promotional language increases the chance of unsafe activation and overreach into financially consequential actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documentation includes a ready-to-run mainnet order placement example against https://api.binance.com without an explicit warning that executing it will place a real market order. In a trading-bot skill context, users are more likely to copy-paste examples directly, which increases the chance of unintended live trades and financial loss.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · binance/spot/references/authentication.md (reported line 70)May include surrounding context.

Request:

bash
curl -X POST "https://api.binance.com/api/v3/order" \
  -H "X-MBX-APIKEY: your_api_key" \
  -H "User-Agent: binance-spot/1.0.1 (Skill)" \
  -d "symbol=BTCUSDT&side=BUY&type=MARKET&quantity=0.001&timestamp=1234567890123&signature=..."

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · binance/spot/references/authentication.md (reported line 70)May include surrounding context.

Request:

bash
curl -X POST "https://api.binance.com/api/v3/order" \
  -H "X-MBX-APIKEY: your_api_key" \
  -H "User-Agent: binance-spot/1.0.1 (Skill)" \
  -d "symbol=BTCUSDT&side=BUY&type=MARKET&quantity=0.001&timestamp=1234567890123&signature=..."

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The shell script is executable as written and demonstrates constructing a signed live POST request with API credentials to place a market order, but it does not clearly warn users about the irreversible effect of running it on mainnet. Because this skill operates a trading bot, such copy-pasteable automation is especially risky and can trigger accidental trades with real funds.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The example trigger phrase is broad, conversational, and likely to appear in normal chat, which can cause accidental activation of a capability that posts publicly to Binance Square. In this skill’s context, unintended invocation is more dangerous because the action is externally visible, can affect a trading persona or reputation, and may consume a stored API credential without the user clearly intending to publish.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The README describes posting content to Binance Square but does not clearly warn that user-provided text will be transmitted to an external third-party service. In an agent setting, users may provide sensitive trading commentary, account details, or private data without realizing it will leave the local environment, creating a privacy and data-handling risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · binance/square-post/SKILL.md (reported line 46)May include surrounding context.

Example Request

bash
curl -X POST 'https://www.binance.com/bapi/composite/v1/public/pgc/openApi/content/add' \
  -H 'X-Square-OpenAPI-Key: your_api_key' \
  -H 'Content-Type: application/json' \
  -H 'clienttype: binanceSkill' \

Scope Creep

Low
Category
Excessive Agency
Confidence
70% confidence
Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · binance/spot/LICENSE.md (reported line 9)May include surrounding context.

md
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Static analysis

No suspicious patterns detected.