ClawHub

AIresearchOS

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed AIresearchOS integration, but it can send research prompts to an external service and optionally spend USDC via a wallet key.

Prefer API-key mode for routine use. If enabling x402, use a dedicated wallet with only the funds you are willing to spend, confirm price and mode before each paid request, avoid untrusted custom base URLs, and expect local npm dependency installation plus background status checks after submitting research.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The README instructs users to place a wallet private key directly into configuration without a prominent warning that this credential grants control over funds and must be handled like a secret. In the context of a skill that performs automated x402 payments, this increases the chance of credential leakage through misconfiguration, accidental file exposure, backups, screenshots, or repository commits, which could lead to unauthorized fund transfers.

External Transmission

Medium
Category
Data Exfiltration
Content
### Submit Research (API Key)

```bash
curl -s -X POST "${AIRESEARCHOS_BASE_URL:-https://airesearchos.com}/api/v1/research" \
  -H "Authorization: Bearer $AIRESEARCHOS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"query":"<USER_QUERY>","mode":"<MODE>","reportLength":"standard","skipClarifyingQuestions":false}'
Confidence
96% confidence
Finding
curl -s -X POST "${AIRESEARCHOS_BASE_URL:-https://airesearchos.com}/api/v1/research" \ -H "Authorization: Bearer $AIRESEARCHOS_API_KEY" \ -H "Content-Type: application/json" \ -d '{"query":"<USE

Unpinned Dependencies

Low
Category
Supply Chain
Content
"type": "module",
  "description": "Helper scripts for the AIresearchOS OpenClaw skill",
  "dependencies": {
    "@x402/core": "^2.3.0",
    "@x402/evm": "^2.3.0",
    "viem": "^2.45.2"
  }
Confidence
91% confidence
Finding
"@x402/core": "^2.3.0"

Unpinned Dependencies

Low
Category
Supply Chain
Content
"description": "Helper scripts for the AIresearchOS OpenClaw skill",
  "dependencies": {
    "@x402/core": "^2.3.0",
    "@x402/evm": "^2.3.0",
    "viem": "^2.45.2"
  }
}
Confidence
91% confidence
Finding
"@x402/evm": "^2.3.0"

Unpinned Dependencies

Low
Category
Supply Chain
Content
"dependencies": {
    "@x402/core": "^2.3.0",
    "@x402/evm": "^2.3.0",
    "viem": "^2.45.2"
  }
}
Confidence
89% confidence
Finding
"viem": "^2.45.2"

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal