ClawHub
Back to skill

Security audit

Indigo Stability

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Indigo Protocol helper that prepares unsigned transaction data, but users must review fund-moving actions before signing them.

Install only if you intend to manage Indigo Stability Pool positions and trust the MCP server you configure. Before signing any returned transaction, verify the address, asset, amount, UTxO, action type, and whether it closes, withdraws from, processes, or cancels a position.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The documentation describes multiple write operations that create, adjust, close, process, or cancel stability-pool positions, but it does not warn that these actions affect live on-chain accounts and may be irreversible once signed and submitted. In a blockchain/DeFi context, missing safety guidance can lead an agent or user to invoke high-impact state-changing operations without confirming ownership, intent, asset, amount, or UTxO references, increasing the risk of accidental fund loss or unintended account changes.

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The skill documents a destructive financial action that closes a stability pool account and withdraws all deposited assets and rewards, but it does not explicitly require a confirmation step or warn about the irreversible operational effect of closing the position. In an agent setting, this increases the risk of accidental account closure from ambiguous user phrasing, misunderstanding, or prompt manipulation, even though the returned transaction is unsigned and still requires client-side signing.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.