Is cybercentry/cybercentry-ethereum-token-verification safe?
This skill presents meaningful security risks despite a clean static install. The SKILL.md instructs the agent to clone and npm-install an external repository (Virtual-Protocol/openclaw-acp), exposing users to arbitrary code execution via npm lifecycle hooks and a persistent operator-controlled CLI with full filesystem access. The service also controls the security verdicts ($1.00 USDC per scan) that are designed to gate automated trading bot decisions, creating a direct financial incentive for the operator to manipulate results. Wallet verification steps reference only operator-controlled sources (clawhub.ai, Twitter), and the recommended verification method is itself a paid Cybercentry product — forming a closed, self-referential trust loop.
Category Scores
Findings (8)
CRITICAL Instructs Agent to npm install External Repository -75 ▶
SKILL.md explicitly and prominently instructs the agent to clone https://github.com/Virtual-Protocol/openclaw-acp and run npm install as a mandatory prerequisite. npm install executes lifecycle scripts (preinstall, postinstall, prepare) that can run arbitrary shell commands with full user permissions. The resulting 'acp' binary then runs on every subsequent verification call, creating a persistent attacker-controlled code execution surface. The skill's own install (git clone of skill files) was clean, but this instruction transfers the risk entirely to runtime.
HIGH Operator Controls Security Verdicts That Gate Financial Transactions -40 ▶
The rug_pull_risk_score, risk_level, and safe_to_interact fields in every API response are generated by the Cybercentry service and returned without independent verification. The skill is explicitly designed to integrate into automated trading bots where these values gate the ./execute-trade.sh execution. A malicious or compromised service could return false SAFE verdicts for scam tokens (enabling the user's bot to buy into rug pulls) or false DANGEROUS verdicts for legitimate tokens (blocking trades). There is no cryptographic or on-chain attestation of the verdicts.
HIGH Circular Cross-Skill Monetization Loop -25 ▶
The skill instructs the agent to verify the payment wallet address using the 'Cybercentry Wallet Verification' skill — another paid Cybercentry service at $1.00 USDC per check. This creates a recursive trust loop: the wallet you pay for token verification is verified by paying for wallet verification from the same vendor. Neither check provides an independent security guarantee, and both generate revenue for the skill author.
HIGH External ACP CLI Gains Persistent Filesystem Access -40 ▶
Once the agent follows the skill's instructions to install and authenticate the Virtual-Protocol/openclaw-acp CLI tool, that binary has access to all files accessible to the user — including .env, SSH keys, AWS credentials, .npmrc, and Docker config — on every invocation. The acp setup step stores authentication tokens on disk. Network traffic from acp commands goes to Virtuals Protocol infrastructure not auditable from this review. Any data the agent holds in memory or on disk at the time of acp execution could be captured.
MEDIUM Verification Sources Are Not Independent -10 ▶
The MANDATORY wallet verification steps direct the agent to check clawhub.ai (the skill's own marketplace, controlled by the operator) and Twitter/@cybercentry (also controlled by the skill author). These are presented as independent verification sources providing security guarantees, but an attacker who controls both can make any wallet address appear legitimate. The verification flow provides psychological reassurance without actual security.
MEDIUM Instructs Agent to Execute USDC Payments to Operator-Controlled Address -25 ▶
The skill instructs the agent to send $1.00 USDC per scan to a wallet address obtained from the ACP marketplace at runtime. The operator controls both the ACP marketplace response (which wallet address is returned) and the verification sources used to validate it. The payment instruction is embedded in shell and Python examples as a normal workflow step, making it easy for an AI agent to execute without user confirmation.
LOW Static Skill Install Was Clean -5 ▶
The git clone of the skill files from openclaw/skills.git was clean. Only GitHub was contacted over the network. Exactly two files were added to the filesystem (SKILL.md and _meta.json). No unexpected process spawning, git hooks, submodules, or symlinks were present. The static install behavior is consistent with a benign documentation-only skill package.
INFO Canary File Reads Attributed to Audit Framework, Not Skill 0 ▶
inotifywait and auditd recorded read accesses to .env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, and .gcloud/application_default_credentials.json. Timestamp correlation confirms both access events (1771926189.026 and 1771926211.133) bracket the install: the first set occurred before the install script started (1771926194.521) as part of audit framework canary initialization, and the second set occurred after the install completed as part of integrity verification. The skill install process itself made no contact with these files.