ClawHub
Back to skill

Security audit

Blockscout for Web3 Dev

Security checks for vulnerabilities and agentic risk

Overview

This is a documentation-only Blockscout API helper that handles API keys and network calls in a disclosed, purpose-aligned way.

Install this only if you want help using the Blockscout PRO API. Use a scoped API key through an environment variable or gitignored secret file, do not paste keys into chat, monitor credits or billing, and avoid enabling it for generic web3 tasks that should not depend on Blockscout.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
82% confidence
Finding
The trigger description is intentionally very broad, including generic phrases like 'build a web3 app', 'wallet history', and 'block explorer API'. That can cause the skill to activate in situations where Blockscout PRO API is not actually appropriate, steering the agent toward unnecessary API-key collection and external requests. In a skill that handles secrets and network access, over-invocation increases security and privacy risk even if the content is not overtly malicious.

Static analysis

No suspicious patterns detected.