ClawHub
Back to skill

Security audit

Crypto Levels Analyzer

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed crypto technical-analysis helper that fetches public market data and does not show hidden trading, wallet access, exfiltration, or persistence behavior.

Install only if you want crypto technical-analysis assistance. Do not treat outputs as personalized financial advice, verify live prices independently, and avoid storing real API keys in files, screenshots, logs, or version control.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
84% confidence
Finding
The activation description is broad enough to trigger on many generic cryptocurrency questions, which can cause the skill to engage outside narrowly intended scenarios. Overbroad triggering increases the chance of inappropriate invocation, unexpected data access through connected tools, or users receiving domain-specific trading guidance when they did not explicitly ask for this skill.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The configuration examples show credential-bearing fields and environment variables in plaintext, including a realistic API key format in the production example. Even if presented as examples, users commonly copy-paste such snippets into files, shell history, logs, screenshots, or version control, which can expose secrets and normalize insecure secret handling.

Missing User Warnings

Low
Confidence
90% confidence
Finding
The guide provides concrete trading execution content such as position sizing, stop-loss placement, take-profit rules, and strategy optimization before giving a meaningful risk warning, with the disclaimer deferred to the end. In a skill designed to answer crypto trading questions, this can encourage users to treat the content as actionable financial guidance without seeing risk framing first, increasing the chance of harmful decisions.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.