ClawHub
Back to skill

Security audit

Send USD Skill

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be a local simulation that reports a USD transfer result but does not actually move money or access payment systems.

Treat this as a simulation or demo skill, not a real payment tool. Before relying on it for actual funds, require a version that clearly documents payment-provider integration, authentication, explicit user confirmation of sender/recipient/amount, audit logging, and transfer limits.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
This skill describes a capability to transfer money between agents but does not require any explicit user confirmation, approval step, or high-friction warning before initiating the transaction. In an agentic environment, that omission can enable unintended, unauthorized, or prompt-induced transfers if another component invokes the skill with attacker-controlled parameters.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.