ClawHub
Back to skill

Security audit

Tyrpay Seller Skill

Security checks across malware telemetry and agentic risk

Overview

The skill appears to document expected credential setup for its tool use, but users should handle the required private keys and API secrets carefully.

Before installing, review the credential setup and use scoped, revocable keys where possible. Do not commit the .env file, share it in chat, or sync it to public or shared storage; treat private keys as capable of authorizing transactions or account actions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
This markdown file documents sensitive credentials including `SELLER_PRIVATE_KEY`, `ZERO_G_STORAGE_PRIVATE_KEY`, `RECLAIM_APP_SECRET`, and `MODEL_API_KEY`, and instructs the reader to copy them into a `.env` file. Under the missing-warning rule for markdown, the file should clearly warn that these values are secrets whose exposure could compromise funds, storage writes, or third-party accounts.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.