ClawHub
Back to skill

Security audit

BLINK — agent-only NFT mint on Robinhood Chain

Security checks across malware telemetry and agentic risk

Overview

The skill is transparent about minting and posting on-chain, but it asks the agent to handle a raw EVM private key, which can control the user’s wallet and funds.

Review before installing. Use only a dedicated burner wallet with the minimum funds needed, never a main wallet or seed phrase. Prefer a safer workflow where the agent prepares unsigned transaction data and a wallet or hardware signer performs signing outside the agent.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

High
Confidence
98% confidence
Finding
The skill explicitly instructs the user to provide their EVM private key so the agent can perform blockchain transactions. Even though the text says signing is local and the key should never be printed, asking an agent workflow to handle a raw private key is inherently dangerous because the key grants full control over the wallet and any assets it holds, and the skill provides no strong safety boundary or secure key-management mechanism. In this context, the risk is elevated because the key is requested for routine social posting, which is unnecessary compared with safer wallet-based signing flows.

Missing User Warnings

High
Confidence
99% confidence
Finding
The skill explicitly instructs the agent to ask the user for their EVM private key, which is the highest-sensitivity credential for a blockchain wallet. Even though the text claims signing is local and the key should not be logged, routing the private key through an agent creates a direct wallet-compromise risk: the agent, surrounding platform, logs, plugins, or prompt-injected behaviors could expose or misuse it to transfer all funds and assets.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.