ClawHub
Back to skill

Security audit

Solana Whale Tracker Pro

Security checks across malware telemetry and agentic risk

Overview

This appears to be a legitimate Solana monitoring skill, with normal alerting and dependency hygiene risks users should configure carefully.

Install only if you are comfortable giving the skill Telegram or email alert credentials. Store secrets in environment variables or a secrets manager, avoid committing config files, rotate tokens if exposed, and pin or audit the Python dependencies before long-running deployment.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The documentation instructs users to configure Telegram bot tokens and email credentials and enables outbound alert channels, but it provides no guidance on secret storage, least-privilege configuration, privacy implications, or the risks of sending sensitive monitoring data to third-party services. In a monitoring skill that may run continuously and handle credentials, this omission can lead to accidental credential exposure, insecure deployment, or unreviewed exfiltration of operational data through notification channels.

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.28.0
python-dotenv>=1.0.0
Confidence
97% confidence
Finding
requests>=2.28.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
requests>=2.28.0
python-dotenv>=1.0.0
Confidence
96% confidence
Finding
python-dotenv>=1.0.0

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High
Category
Supply Chain
Confidence
93% confidence
Finding
requests

Known Vulnerable Dependency: python-dotenv — 1 advisory(ies): CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via )

Low
Category
Supply Chain
Confidence
71% confidence
Finding
python-dotenv

VirusTotal

No VirusTotal findings

View on VirusTotal

Static analysis

No suspicious patterns detected.