ClawHub
Back to skill

Security audit

Crypto Research

Security checks across malware telemetry and agentic risk

Overview

This Cesto skill is a disclosed market-data and basket-management helper with user confirmation before public posting, though users should treat its investment outputs cautiously.

Install only if you want an agent to query Cesto market data and help manage Cesto Labs baskets. Review outputs as informational, not financial advice, and confirm carefully before publishing any basket because that creates public content on Cesto.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
94% confidence
Finding
The trigger phrases are broad enough to match ordinary conversational prompts like 'tell me about [coin]' or 'should I invest in [coin]', which can cause the skill to activate in contexts where the user did not explicitly request deep crypto due diligence. In an investment-related skill, overbroad activation increases the chance of unsolicited financial-analysis behavior and unnecessary tool use, which can misroute user intent and produce higher-risk advice-like outputs.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.