ClawHub
Back to skill

Security audit

Solana Monitor Pro

Security checks across malware telemetry and agentic risk

Overview

This Solana monitoring skill matches its stated purpose, but users should protect notification credentials and review dependency versions before running it.

Install only if you are comfortable sending Solana monitoring alerts through Telegram or email. Use a dedicated Telegram bot and app-specific email password, keep config/.env files out of source control with restrictive permissions, and consider pinning or reviewing dependency versions before use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The documentation instructs users to place sensitive Telegram bot tokens and email credentials directly into a config file, but provides no guidance on secret storage, access control, rotation, or the privacy implications of sending alerts to third-party services. This can lead to credential leakage through source control, shared workspaces, logs, or backups, and can expose monitored trading or account data via outbound notifications.

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.28.0
python-dotenv>=1.0.0
Confidence
93% confidence
Finding
requests>=2.28.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.28.0
python-dotenv>=1.0.0
Confidence
93% confidence
Finding
python-dotenv>=1.0.0

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High
Category
Supply Chain
Confidence
95% confidence
Finding
requests

Known Vulnerable Dependency: python-dotenv — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low
Category
Supply Chain
Confidence
69% confidence
Finding
python-dotenv

VirusTotal

52/52 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.