crypto-portfolio-tracker Security Audit Report
crypto-portfolio-tracker is an AI agent skill, created by crypto-tools-pro. ClawSecure audited crypto-portfolio-tracker through the 3-Layer Audit Protocol covering all ten OWASP ASI Top 10 categories, assigning a security score of 0/100 (High Risk). The 52 findings concentrate in Supply Chain, Malicious Code and Data Exfiltration, including Pattern detected: base64.b64encode and Pattern detected: base64.b64encode. 35 were rated high or critical severity.
Is crypto-portfolio-tracker safe?
ClawSecure audited crypto-portfolio-tracker and assigned a security score of 0/100 (High Risk), identifying 52 findings across Supply Chain and Malicious Code. Review the findings below before installing.
What did ClawSecure find in crypto-portfolio-tracker?
ClawSecure identified 52 findings in crypto-portfolio-tracker, concentrated in Supply Chain, Malicious Code and Data Exfiltration. 35 were rated high or critical severity. The most severe include Pattern detected: base64.b64encode and Pattern detected: base64.b64encode.
How was crypto-portfolio-tracker audited?
ClawSecure ran crypto-portfolio-tracker through its 3-Layer Audit Protocol with full OWASP ASI Top 10 coverage.
What does a score of 0 mean?
ClawSecure assigned crypto-portfolio-tracker a security score of 0/100, placing it in the High Risk range. This is driven by 52 findings led by Supply Chain that should be addressed before use. ClawSecure derives this score with a weighted deduction model (critical -20, high -10, medium -5, low -2 from a base of 100).
Audit Findings for crypto-portfolio-tracker
ClawSecure detected 52 security findings in crypto-portfolio-tracker, spanning Supply Chain, Malicious Code, Data Exfiltration and Cve.
- critical · Pattern detected: base64.b64encode. Data Exfiltration finding detected in
tracker.py:36. - critical · Pattern detected: base64.b64encode. Data Exfiltration finding detected in
tracker.py:48. - critical · Detects command injection patterns in agent skills: shell operators,.... Command Injection finding detected in
SKILL.md:24. - critical · Detects command injection patterns in agent skills: shell operators,.... Command Injection finding detected in
SKILL.md:25. - critical · Detects prompt strings used to override or force malicious tool calls:.... Prompt Injection finding detected in
SKILL.md:21. - critical · Suspicious domain detected: glot.io (potential data exfiltration). Malicious Code finding detected in
SKILL.md. - critical · Suspicious domain detected: webhook.site (potential data exfiltration). Malicious Code finding detected in
SKILL.md. - critical · CVE-2026-25253: Dangerous configuration modification detected.... Cve finding detected in
SKILL.md. - critical · CVE-2026-25253: Dangerous configuration modification detected.... Cve finding detected in
SKILL.md. - critical · CVE-2026-25253: Dangerous configuration modification detected.... Cve finding detected in
config.json. - critical · CVE-2026-25253: Dangerous configuration modification detected.... Cve finding detected in
config.json. - critical · ClawHavoc C2 infrastructure detected: 91.92.242.30. Malicious Code finding detected in
tracker.py.
Showing the 12 highest-severity of 52 findings. The full interactive list appears below.
3-Layer Audit Protocol
Security Recommendations for crypto-portfolio-tracker
Update and pin dependencies
Audit external network connections
Investigate prompt injection vectors
Related Security Research
AI Agent Supply Chain Attacks: How Dependencies Become Weapons→Beyond Static Scans: Why ClawSecure Verifies Agentic Intent→Related AI Agent Security Audits
Scanned on February 6, 2026. crypto-portfolio-tracker is one of thousands of agents audited by ClawSecure from the community-curated awesome-openclaw-skills list and the openclaw/skills repository.