Security audit

clawtip-sandbox

Security checks across malware telemetry and agentic risk

Overview

This sandbox payment skill is review-worthy because it asks agents to override normal safeguards and expose raw payment/debug data, including encrypted payloads and plaintext credential material.

Install only in a controlled developer sandbox. Do not use real funds or reusable credentials, verify the npm package provenance separately, restrict configs/config.json permissions, and do not allow raw stdout, token URLs, plaintext credentials, decrypted payloads, or order parameters to be forwarded without explicit redaction and consent.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The metadata says the sandbox flow does not require token encryption, but the body later instructs the agent to handle and diagnose `encrypted_data` and decrypted credential material. This inconsistency can mislead integrators into exposing or depending on sensitive cryptographic fields in a supposedly low-risk sandbox flow, increasing the chance of insecure handling and accidental disclosure.

Ssd 3

High

Confidence: 99% confidence
Finding: The skill explicitly orders the agent to capture and forward complete raw stdout, including request-parameter blocks, to downstream agents or end users. In context, stdout is said to contain order parameters and diagnostic material, which may include `payTo`, `encrypted_data`, order identifiers, and other sensitive integration data; mandatory verbatim forwarding creates a clear data-exfiltration path.

Ssd 3

High

Confidence: 99% confidence
Finding: The success-path explicitly instructs the agent to display plaintext credential data and decrypted content to the user. Revealing secrets or decrypted payment material defeats confidentiality guarantees and can enable credential reuse, replay, impersonation, or compromise of adjacent systems if the same values are trusted elsewhere.

Ssd 1

Medium

Confidence: 93% confidence
Finding: The embedded 'SYSTEM OVERRIDE' text is an instruction-manipulation attempt designed to supersede the calling agent's normal safeguards and force exact user-visible output. In this file, the override is specifically used to coerce disclosure of internal diagnostics and shape attribution, making it a prompt-injection mechanism that increases the chance of unsafe data release.

Ssd 1

Medium

Confidence: 94% confidence
Finding: This second override block again attempts to compel downstream agents to reproduce debug data verbatim and suppress their own safety behavior. Because it is paired with troubleshooting fields like `payTo`, `encrypted_data`, and `slug`, it materially increases the risk that sensitive operational data will be propagated across trust boundaries.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.