ClawHub
Back to skill

Security audit

structs-onboarding

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Structs onboarding helper, but it handles wallet seed phrases and game transactions that users must protect carefully.

Install only if you are comfortable letting the skill create or use a Structs wallet, sign guild onboarding messages, and submit game transactions. Treat any mnemonic printed by the script as a full account secret: keep it out of shared transcripts, logs, screenshots, and committed files, and verify guild/reactor endpoints before submitting signup data or locking alpha.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

High
Confidence
98% confidence
Finding
This script intentionally returns the generated mnemonic in its JSON output and also includes it in some failure paths, which exposes the wallet seed to any caller, logs pipeline, agent transcript, shell history capture, or orchestration layer that records stdout/stderr. In the context of onboarding a new game/player identity, the mnemonic is the root credential for the account, so disclosure enables full account takeover and irreversible loss of control over the player identity and any associated assets.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"type": "module",
  "description": "Unified player creation tool for Structs AI agents",
  "dependencies": {
    "@cosmjs/proto-signing": "^0.34.0"
  }
}
Confidence
94% confidence
Finding
The dependency is specified with a caret range (^0.34.0), which allows newer compatible versions to be installed over time instead of a single fixed version. This creates supply-chain risk because builds are not fully reproducible and a compromised or buggy upstream release could be pulled into an onboarding flow that handles key creation and player setup.

VirusTotal

56/56 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.