ClawHub
Back to skill

Security audit

Nudge Marketplace

Security checks across malware telemetry and agentic risk

Overview

The skill is a mostly coherent marketplace guide, but its payment instructions conflict and its example code normalizes raw private-key token transfers.

Browsing agents appears low risk. Before submitting an agent or paying a listing fee, independently verify the official domain, token, network, amount, recipient wallet, and current x402 response. Do not paste a valuable wallet private key into an agent session; use a dedicated low-balance wallet or external signer and manually review any transaction.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The skill contradicts itself about the required payment currency, describing the fee as $NUDGE in some places and USDC-equivalent/USDC in others. In the context of wallet-based token transfers, this ambiguity is dangerous because users may approve or transfer the wrong asset, and blockchain transactions are typically irreversible.

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The skill contradicts itself about the required payment currency, describing the fee as $NUDGE in some places and USDC-equivalent/USDC in others. In the context of wallet-based token transfers, this ambiguity is dangerous because users may approve or transfer the wrong asset, and blockchain transactions are typically irreversible.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill includes concrete instructions to perform an on-chain token transfer and submit a payment proof, but does not clearly warn users that these actions may involve real wallet operations, irreversible blockchain transactions, and potential financial loss. Because the skill is operational rather than purely informational, omission of a clear warning increases the chance that a user follows the steps without understanding the risk.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.