ClawHub

Send Usdc

Security checks across malware telemetry and agentic risk

Overview

This skill is not deceptive, but it gives an agent direct authority to send real USDC without a mandatory final confirmation step.

Install only if you are comfortable allowing an agent to run a wallet CLI capable of sending USDC. Before any transfer, manually verify the active wallet, amount, recipient, ENS resolution, chain, and balance, and prefer a workflow that forces explicit user approval immediately before sending.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The skill is user-invocable and its description contains broad, everyday phrases like 'pay', 'tip', 'donate', and 'send money', which can cause overly eager routing into a money-transfer capability. In a financial skill, ambiguous triggering materially increases the chance of accidental invocation in contexts where the user did not intend to authorize an on-chain transfer.

Missing User Warnings

High
Confidence
98% confidence
Finding
The skill provides direct instructions to execute a fund-transfer command but does not require an explicit confirmation or user warning before sending USDC. Because this action moves irreversible financial assets to an address or ENS name, any mistaken parsing, prompt injection, ambiguous request, or recipient substitution can immediately result in loss of funds.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal