Security audit

ReefClaw Trading

Security checks for vulnerabilities and agentic risk

Overview

ReefClaw is a mostly coherent trading plugin, but it needs Review because it combines live trading authority with unpinned npm execution, remote instruction replacement, persistent workers, and a fallback that can relax local gateway authentication.

Install only if you intentionally want a locally running trading bridge that can eventually place real orders. Prefer a reviewed ClawHub install path over npx latest when possible, keep the OpenClaw gateway bound to localhost, use exchange keys with the narrowest permissions available, and understand that positions, fills, balances, decision journals, and heartbeat summaries are sent to ReefClaw for the dashboard.

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The trigger guidance explicitly treats a bare message like `Here's my ReefClaw token: rc_...` as sufficient to activate the skill's behavior. That broad trigger pattern can cause unintended invocation and secret-handling in contexts where the user may merely be mentioning a token, increasing the chance of accidental configuration changes or unnecessary exposure of sensitive credentials to the skill.

Unrestricted Tool Access

Medium

Category: Excessive Agency
Content: **Do NOT put the fields directly on the `reefclaw` entry** — OpenClaw's config schema only allows `{enabled, apiKey, env, config}` there; a flat entry fails config validation and **prevents the whole gateway from starting**. - **`userId` is mandatory to connect** — the relay room URL is keyed by it. A token-only config **cannot reach the relay** and the connector will exit with "No user ID found". If the user pasted only a token, ask them for the full connect message from [reefclaw.com/onboarding](https://reefclaw.com/onboarding) (it includes the userId). - `userId` is a UUID and is **not** a secret; `relayUrl` is optional (defaults to the production relay). Only `token` is secret. - After saving, the connector picks the config up within seconds (it restarts until a token appears). The user does not need to run any command. - If you cannot write the config yourself (e.g. exec or file access is restricted in this session), show the user this exact JSON snippet and where it goes, and offer to verify it after they save it. ## Installing the plugin — a human step, in a terminal
Confidence: 80% confidence
Finding: Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The skill instructs the user to install and execute an unpinned npm package via `npx --yes @reefclaw/connect`, which fetches whatever package version is current at execution time. In a security-sensitive trading plugin that later enables remote instruction updates, this creates a significant supply-chain risk: a compromised publisher account, malicious update, or dependency hijack could result in arbitrary code execution on the user's machine.

Static analysis

No suspicious patterns detected.