ClawHub
Back to skill

Security audit

axiom_wallet

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly coherent for an Axiom Wallet payment workflow, but it handles live OAuth setup material in an unsafe temporary-file troubleshooting path.

Review this skill before installing because it connects to a payment wallet and can start user-requested purchases. Avoid the documented /tmp OAuth URL interception fallback unless you can secure and immediately delete the captured file; prefer the normal mcporter log-based or browser-based authentication flow.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The troubleshooting fallback instructs users to intercept the system-opened OAuth URL and write it to /tmp/axiom-auth-url.txt. Although this is not an access token, it is still live authentication material tied to an in-progress OAuth/device-flow session and may include sensitive parameters; writing it to a world-accessible temporary path increases the risk of local disclosure, session hijacking, or unintended reuse before expiry.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.