ClawHub

Token Launcher - Token Launch Pad

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only crypto token launch skill with real financial risk, but its external API calls, wallet use, fees, and irreversible on-chain effects are disclosed and aligned with its purpose.

Install only if you intend to work on crypto token launches or fee management. Treat every API call, wallet signature, transaction, fee-recipient address, and bot-wallet setup as a real financial action; use a dedicated wallet with minimal funds and verify contract addresses, payment details, and recipients before proceeding.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger list includes generic phrases like "launch a token," "deploy a token," and especially "is this a good token," which are broad enough to overlap with common crypto discussion rather than a clearly bounded skill invocation. The description does not provide exclusion conditions, negative examples, or activation constraints to clarify when the skill should not activate.

External Transmission

Medium
Category
Data Exfiltration
Content
After deploying via any platform, run a Quick Intel scan to verify the contract looks clean from an external perspective:

```bash
curl -X POST https://x402.quickintel.io/v1/scan/full \
  -H "Content-Type: application/json" \
  -H "PAYMENT-SIGNATURE: <x402_payment>" \
  -d '{"chain": "base", "tokenAddress": "0xYourDeployedToken"}'
Confidence
60% confidence
Finding
curl -X POST https://x402.quickintel.io/v1/scan/full \ -H "Content-Type: application/json" \ -H "PAYMENT-SIGNATURE: <x402_payment>" \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
### Launch a Token

```bash
curl -X POST https://x402.quickintel.io/v1/tator/prompt \
  -H "Content-Type: application/json" \
  -H "PAYMENT-SIGNATURE: <x402_payment>" \
  -d '{
Confidence
60% confidence
Finding
curl -X POST https://x402.quickintel.io/v1/tator/prompt \ -H "Content-Type: application/json" \ -H "PAYMENT-SIGNATURE: <x402_payment>" \ -d

Unrestricted Tool Access

Medium
Category
Excessive Agency
Content
# Token Launcher — Direct Mode Reference

> **This file is developer documentation only.** It contains code examples and integration patterns for developers to implement in their own codebase. This skill does not execute any code, does not access environment variables, and does not handle private keys at runtime. All code samples below are reference material — they run in your infrastructure, not in this skill.

Direct Mode means integrating with Clanker, Flaunch, or Pump.fun directly from your own application code. You keep 100% of creator fees — no interface cut, no platform overhead.
Confidence
80% confidence
Finding
execute any code

Unrestricted Tool Access

Medium
Category
Excessive Agency
Content
### API Input Safety

The Tator API accepts a `prompt` field — this is a **parameter name for an external API call to Tator's trading service**, not a prompt for the agent's own LLM. The value is sent to `x402.quickintel.io` where Tator's server parses it and executes the requested operation. The API is server-side validated and only processes recognized trading operations. It does not execute arbitrary code or access filesystems.

The `PAYMENT-SIGNATURE` header shown in the examples is a wallet-signed USDC payment authorization created by the user's x402-compatible wallet. It is not an API key, stored secret, or environment variable — it is generated per-request by the wallet and verified on-chain by the API.
Confidence
80% confidence
Finding
execute arbitrary code

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal