ClawHub
Back to skill

Security audit

StablePay Agent Bootstrap

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a disclosed StablePay setup guide, but it also includes account- and package-publishing actions that are not clearly gated by explicit user approval.

Review this skill before installing if you do not intend to let an agent install npm packages, modify MCP configuration, run StablePay wallet onboarding, or publish an npm package. Use it only with explicit prompts for the specific setup step you want, and require confirmation before any global install, wallet/payment-limit change, MCP config write, or npm publish command.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
94% confidence
Finding
The skill directs the agent to install a global package, run onboarding commands, modify MCP configuration, and even publish a package, but it does not require an explicit warning or confirmation before making system or account-affecting changes. In an agent context, this can lead to unintended software installation, persistent config changes, or accidental package publication if the instructions are followed autonomously.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.