ClawHub
Back to skill

Security audit

Crypto Wave Scanner

Security checks across malware telemetry and agentic risk

Overview

This is a public crypto market scanner with no account access or trading authority, but users should treat its signals as informational because some methodology and disclosure details are imperfect.

Install only if you understand that this is a market-analysis aid, not financial advice or an automated trading system. Verify signals against exchange data before acting, be aware the browser and CLI do not compute every signal identically, stop the local server when finished, and consider the third-party charting CDN dependency.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
84% confidence
Finding
The documented behavior materially overstates or misrepresents what the skill actually does, including claims about real-time scanning, dashboard functionality, coin coverage, and endpoint usage. This is dangerous because users may make financial or operational decisions based on false assumptions, and behavior mismatches can conceal undeclared network activity or incomplete functionality that has not been properly reviewed.

Intent-Code Divergence

Medium
Confidence
98% confidence
Finding
The UI and comments indicate a 1h trend check, but the code computes the trend from the currently selected timeframe instead of separately fetched 1h candles. In a trading tool, this is a security-relevant integrity issue because users may make leveraged decisions based on materially false signals presented as higher-timeframe confirmation.

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The skill metadata promises scoring with a real 1h trend signal, but the implementation never retrieves separate 1h market data. This mismatch can mislead users into overtrusting the scanner's output, especially in a futures-trading context where inaccurate claims about signal quality can directly contribute to financial loss.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The dashboard presents concrete entry limits, take-profit targets, stop levels, and graded trade recommendations without any visible financial-risk warning or disclaimer. In a crypto futures skill, that increases harm potential because users may interpret the output as dependable trading advice and act without understanding leverage, volatility, or model limitations.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal