ClawHub
Back to skill

Security audit

Agent Wallet (Lobster)

Security checks across malware telemetry and agentic risk

Overview

This wallet skill does what it claims, but it can authorize real USDC payments from server-provided terms without enough user-visible limits or checks.

Install only with a dedicated low-balance or testnet wallet, and avoid untrusted payment URLs. Before using it with real funds, look for a version that previews and enforces recipient, token contract, network, amount, expiry, domain allowlists, and spend limits before any signature is created.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The docstring states that x402Fetch requires an explicit confirmation flag, but the implementation automatically signs a payment authorization and retries the request whenever it receives a 402 response. This mismatch can mislead integrators into believing a consent gate exists when it does not, causing unintended payment authorizations to be signed for untrusted endpoints.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The client automatically transmits a signed X-Payment header to any URL that returns a parseable 402 payment challenge, with no user disclosure, origin allowlist, or confirmation step. In this context, that is dangerous because the skill is explicitly a payment client that signs EIP-3009 authorizations in memory, so an attacker-controlled endpoint could induce unintended payment signing and submission.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
lib/core.mjs:64