Massat Security Audit

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only paid audit API skill that clearly discloses its external API use and x402 payment flow, with no hidden code or persistence in the provided artifacts.

This skill appears coherent and transparent for a paid external security-audit API. Before using it, confirm you are allowed to share the target repository or system with the provider, and approve any x402 payment token only when you intentionally want the $50 full audit.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#
ASI07: Insecure Inter-Agent Communication
Low
What this means

Private repository names, URLs, or audit targets could be revealed to the external audit service if the user submits them.

Why it was flagged

The skill sends a user-selected audit target to an external provider. This is disclosed and central to the purpose, but users should treat repository URLs or target details as shared with that service.

Skill content
Run a comprehensive OWASP ASI01-ASI10 security assessment ... via the BlindOracle API ... curl -X POST https://craigmbrown.com/api/v1/massat/audit ... "target": "https://github.com/your-org/your-agent-repo"
Recommendation

Only submit repositories or systems you are authorized to share with the provider, and check the provider's privacy/retention terms before using it for private targets.

#
ASI03: Identity and Privilege Abuse
Medium
What this means

A full audit may spend $50 or consume an ecash/payment token if the paid endpoint is used.

Why it was flagged

The skill uses an x402 payment token for paid full audits. This is clearly disclosed and purpose-aligned, but it involves financial authority.

Skill content
pricing:\n  model: per-use\n  amount: 50\n  currency: USD\n  payment: x402 ... Full audits use x402 micropayments. Include `X-Payment: x402` header with ecash token.
Recommendation

Require explicit user approval before sending any x402 payment token, and use the free quick scan unless the user intentionally chooses the paid full audit.