Skill Trust Decision
clawpi-redpacket-monitor
The skill performs auto-claiming of cryptocurrency red packets using JWT tokens extracted from a wallet config file, with extensive undeclared shell execution via execSync/curl that is not disclosed in documentation.
Most direct threat evidence
High Credential Theft
Undeclared JWT token extraction from wallet config The getJWT() function reads JWT tokens from ~/.fluxa-ai-wallet-mcp/config.json without declaring this behavior in SKILL.md. This accesses sensitive authentication credentials.
scripts/monitor.cjs:65-68 Why this conclusion was reached
2/4 dimensions flagged Block
Declared vs actual capability
3 undeclared or violating capabilities were inferred.
Review
Hidden execution and egress
3 lower-risk artifacts were extracted and still need context.
Block
Attack chain and severe findings
The report includes 0 attack-chain steps and 2 severe findings.
Review
Dependencies and supply chain hygiene
Dependency information is incomplete, so supply-chain confidence stays limited.
What drove the risk score up
Undeclared credential file access +15
SKILL.md does not mention reading JWT from ~/.fluxa-ai-wallet-mcp/config.json
Extensive shell execution via execSync +15
All API calls use execSync with curl - not declared in SKILL.md
Auto-claiming financial assets +10
Automatically claims cryptocurrency without explicit user confirmation
Hardcoded API endpoint +5
clawpi-v2.vercel.app endpoint hardcoded without explanation
Most important evidence
High Credential Theft
Undeclared JWT token extraction from wallet config
The getJWT() function reads JWT tokens from ~/.fluxa-ai-wallet-mcp/config.json without declaring this behavior in SKILL.md. This accesses sensitive authentication credentials.
scripts/monitor.cjs:65-68 Document that the skill accesses the FluxA wallet config file to retrieve JWT tokens for API authentication. Consider using a more secure credential management approach.
High RCE
Extensive execSync usage with curl not declared
All API calls use execSync with curl commands (lines 76, 89, 107, 127, 134) instead of native HTTP libraries. This shell execution pattern is not disclosed in SKILL.md.
scripts/monitor.cjs:76,89,107,127,134 Document the use of execSync and curl for API calls. Consider refactoring to use native fetch or http modules for better security and transparency.
Medium Doc Mismatch
SKILL.md does not mention credential access
SKILL.md describes auto-claiming red packets but does not mention that the skill reads JWT tokens from a wallet configuration file in the user's home directory.
SKILL.md:1-148 Add a 'Required Access' or 'Permissions' section to SKILL.md that explicitly lists: 1) Reading from ~/.fluxa-ai-wallet-mcp/config.json, 2) Shell execution via execSync/curl, 3) External API calls to clawpi-v2.vercel.app
Medium Sensitive Access
Hardcoded paths and external dependencies
The skill hardcodes paths like /Users/xufan65/.openclaw/workspace and ~/.fluxa-ai-wallet-mcp/config.json which are specific to a developer's environment. This suggests the skill may have been developed for personal use and assumes specific system configurations.
scripts/monitor.cjs:18,66 Make paths configurable and avoid hardcoded developer-specific paths. Consider using environment variables or configuration files for customization.
Declared capability vs actual capability
Filesystem Block
Declared NONE
→ Inferred READ
scripts/monitor.cjs:65-68 reads ~/.fluxa-ai-wallet-mcp/config.json Shell Block
Declared NONE
→ Inferred WRITE
scripts/monitor.cjs:76,89,107,127 uses execSync with curl commands Network Block
Declared NONE
→ Inferred WRITE
scripts/monitor.cjs:76 makes POST requests to external API Suspicious artifacts and egress
Medium External URL
https://clawpi-v2.vercel.app/api/redpacket/available?n=20&offset=0 scripts/monitor.cjs:85
Medium External URL
https://clawpi-v2.vercel.app/api/redpacket/claim scripts/monitor.cjs:130
Medium External URL
https://clawpi-v2.vercel.app/api/moments/create scripts/monitor.cjs:156
Dependencies and supply chain
There are no structured dependency warnings.
File composition
5 files · 467 lines
JavaScript 1 files · 287 linesMarkdown 1 files · 148 linesJSON 3 files · 32 lines
Files of concern · 2
scripts/monitor.cjs Undeclared JWT token extraction from wallet config · Extensive execSync usage with curl not declared · Hardcoded paths and external dependencies · https://clawpi-v2.vercel.app/api/redpacket/available?n=20&offset=0 · https://clawpi-v2.vercel.app/api/redpacket/claim · https://clawpi-v2.vercel.app/api/moments/create
SKILL.md SKILL.md does not mention credential access
Other files · package.json · _meta.json · settings.json
Security positives
The skill uses file-based state management for tracking claimed red packets, avoiding duplicate claims
No obvious data exfiltration or C2 communication patterns detected
The JWT is used locally for API authentication, not exfiltrated
Error handling is present throughout the codebase