ClawHub
Back to skill

Security audit

Agent Credit

Security checks across malware telemetry and agentic risk

Overview

The skill is transparent about its purpose, but it gives an AI agent real on-chain borrowing and repayment authority using a locally stored wallet key.

Install only if you intentionally want an agent to borrow and repay on Aave using delegated credit. Use a dedicated low-balance agent wallet, avoid keeping the key in plaintext config if possible, set small per-asset delegation limits, test on testnet first, monitor health factor externally, review every borrow/repay action, and revoke delegation when idle.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The status script reads the agent private key from configuration and uses it to derive the agent address, even though a read-only status check does not need signing capability. This unnecessarily expands the secret exposure surface: any user able to invoke or inspect this script path may trigger handling of a sensitive key, and compromise of the script environment or logs would have more severe consequences than a purely public-data status query.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill instructs users to place an agent private key in local configuration while enabling autonomous on-chain borrowing and token approvals. Even though it warns not to commit the file, it does not explicitly warn that compromise of the agent environment or misuse by the agent can drain all assets held by that wallet and incur real debt against the delegator's collateral.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The script submits on-chain approve and repay transactions immediately once invoked, using a locally available private key and without any interactive confirmation or dry-run safeguard. In the context of an agent skill that can self-fund and act on behalf of a delegator, a malformed invocation, wrong config, compromised upstream agent decision, or unexpected asset/amount selection can cause irreversible token approvals and repayments to be broadcast before an operator can stop them.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The file gives concrete instructions for using Aave credit delegation and borrowing, including how to locate the VariableDebtToken and invoke delegation-related functions, but it does not warn users that these actions create debt against a delegator's collateral and can lead to liquidation, allowance misuse, or irreversible financial loss. In the context of an agent skill explicitly designed to self-fund by borrowing, omission of risk disclosures makes unsafe operation more likely and increases the chance that users delegate credit or borrow on the wrong asset/network without understanding consequences.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.