ClawHub
Back to skill

Security audit

agentrade-skill

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Agentrade CLI runbook with credentialed write workflows, and I found no hidden code, exfiltration, or deceptive behavior.

Install this only if you intend your agent to operate Agentrade. Review the external @agentrade/cli package before running it, use token/private-key/admin-key file inputs instead of inline arguments, avoid admin settings commands unless you are explicitly authorized, and consider disabling implicit use or requiring confirmation before write commands if your environment expects human approval.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The skill's invocation criteria are broad and include generic situations like asking how to operate Agentrade or needing auditable JSON-first execution, which can cause the skill to activate in contexts where the user did not intend authenticated task or dispute operations. In a skill that can guide or trigger state-changing CLI/API actions, over-broad activation increases the chance of unintended use, misrouting, or accidental execution against live accounts and platform state.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.