ClawHub
Back to skill

Security audit

BNB Chain

Security checks across malware telemetry and agentic risk

Overview

This BNB Chain skill appears to do its advertised wallet tasks, but it can spend real cryptocurrency using raw private keys without strong safeguards.

Review before installing. Use only a dedicated low-balance wallet, avoid passing private keys on the command line, prefer a protected secret mechanism, and manually verify the network, token contract, recipient, and amount before any send command.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill documentation explicitly instructs users to provide or export a private key via environment variables, but the manifest does not declare the corresponding env capability/permission. This creates a transparency and review gap: a user or platform may believe the skill is low-risk while it handles highly sensitive secrets needed to authorize irreversible blockchain transfers.

Tp4

High
Category
MCP Tool Poisoning
Confidence
79% confidence
Finding
The manifest describes only basic balance and token-transfer operations, but the documentation also exposes private-key-derived address lookup and arbitrary transaction inspection. This mismatch can undermine informed consent and security review, because additional sensitive or security-relevant behaviors are available beyond the declared scope.

Description-Behavior Mismatch

Medium
Confidence
89% confidence
Finding
The skill exposes functionality beyond its declared purpose by supporting private-key-derived address/public key output and arbitrary transaction lookup. Scope creep in a wallet-handling skill increases attack surface and can normalize unnecessary secret handling, which is risky in an agent/tooling context where users may provide sensitive keys to capabilities they did not expect.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
The `address` command accepts a raw private key and derives/exposes wallet metadata, including the public key, despite this not being necessary for basic balance and send operations. Any feature that invites users or upstream agents to supply raw private keys increases the chance of secret disclosure through shell history, logs, prompts, or misuse by surrounding systems.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The examples encourage passing private keys directly on the command line, which can expose them through shell history, process listings, logs, terminal recordings, and CI telemetry. Because the private key grants full control over on-chain funds, disclosure can immediately lead to wallet compromise and irreversible asset theft.

Missing User Warnings

Medium
Confidence
83% confidence
Finding
The transaction-sending commands can trigger real, irreversible blockchain transfers, but the examples do not prominently warn users before invoking them. In the context of a financial/blockchain skill, insufficient warning increases the chance of accidental loss through operator error, wrong network assumptions, or misuse by downstream agents.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The CLI explicitly supports passing a private key as a command-line argument via `--key`, which is commonly exposed through shell history, process listings, audit logs, and orchestration tooling. In a skill that can transfer BNB and tokens, exposure of the key can directly lead to theft of all funds controlled by that wallet.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"license": "ISC",
  "description": "",
  "dependencies": {
    "ethers": "^6.16.0"
  }
}
Confidence
96% confidence
Finding
"ethers": "^6.16.0"

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.