ClawHub
Back to skill

Security audit

Nadname Agent

Security checks across malware telemetry and agentic risk

Overview

The skill mostly matches its .nad registration purpose, but it handles wallet secrets and live blockchain transactions while some lookup results are simulated or overstated as real.

Review carefully before installing. Use a dedicated low-balance wallet, prefer --dry-run first, verify name availability and ownership through official NNS sources, and avoid exposing a primary wallet private key. Treat managed mode as experimental because it stores local wallet material and prints the recovery phrase during setup.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (13)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill documents use of the PRIVATE_KEY environment variable and managed keystore behavior, but the manifest does not declare corresponding permissions/capabilities. This creates a trust and review gap: an agent operator may approve the skill assuming limited scope while it can access sensitive secrets needed to sign transactions.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding
The documented purpose is narrow, but the described behavior expands into wallet creation/storage, address lookups, API-driven pricing, and fallback simulated results. This mismatch can mislead users and reviewers about the true security boundary, especially because wallet generation and encrypted key storage materially increase the risk profile beyond simple name registration.

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The script advertises that it queries the Monad blockchain for accurate fallback data, but the implemented fallback does not perform any contract read and instead relies on hardcoded guesses. This can mislead users into believing a name is available when it is not, causing unsafe downstream actions such as attempted registration, wasted fees, or trust in falsified results.

Intent-Code Divergence

High
Confidence
97% confidence
Finding
The comments and control flow state that the code is performing an on-chain check, but no blockchain contract query occurs. In a blockchain registration skill, this mismatch is dangerous because users may rely on simulated availability as if it were authoritative network state.

Intent-Code Divergence

High
Confidence
100% confidence
Finding
The fallback function returns simulated results based on a small hardcoded blocklist and even 'assumes available' on errors, which is the opposite of a safe verification model. In the context of name registration on a blockchain, this can directly produce false availability claims and drive users toward erroneous or costly actions.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The script claims to perform an NNS blockchain lookup, but the core lookup path is explicitly a simulation that fabricates results from address substrings instead of querying the contract. In a wallet/blockchain skill, misleading users about on-chain ownership data can cause incorrect operational decisions, false trust in registrations, and unsafe follow-on actions such as assuming assets exist or selecting the wrong address for later transactions.

Intent-Code Divergence

Medium
Confidence
94% confidence
Finding
The header explicitly presents the script as a read-only lookup utility, but the implementation does not actually retrieve owned names and instead returns mock output. This kind of deceptive mismatch is especially risky in a blockchain agent skill because users may rely on the output as authoritative wallet/account state, leading to confusion, bad transactions, or social-engineering-style trust in false results.

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The script goes beyond simple name registration by generating a new wallet, storing an encrypted private key, optionally storing an encrypted mnemonic, and handling wallet secrets locally. Expanding the trust boundary to key management materially increases risk because bugs in the crypto/storage flow can expose funds or cause users to create and rely on a wallet they did not intend this tool to manage.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The README instructs users to export a private key and run a registration command, but it does not clearly state that this will broadcast a real blockchain transaction and spend funds for gas and registration fees. Users may test the command assuming it is a dry run or demo flow, leading to unintended on-chain actions and financial loss.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The script prints the wallet mnemonic phrase directly to the terminal immediately after wallet creation. Terminal output may be captured by shell history tools, logging systems, screen recording, remote sessions, or shoulder-surfing, and anyone who obtains the mnemonic can fully take over the wallet and drain funds.

Hidden Instructions

High
Category
Prompt Injection
Content
- ๐Ÿ” Real-time name availability checking via API endpoints
- ๐Ÿ’ฐ Real-time pricing from NAD API
- โ›ฝ Dynamic gas estimation with 2x safety buffer (~1,000,000 gas)
- ๐Ÿƒโ€โ™‚๏ธ `--dry-run` flag for testing without spending tokens
- ๐Ÿ”— `--referrer` support for potential discounts
- ๐Ÿ“Š Better error handling and transaction feedback
- ๐Ÿ™ **Thanks to CloudLobster** for testing and discovering the real flow!
Confidence
71% confidence
Finding
โ€

Unpinned Dependencies

Low
Category
Supply Chain
Content
"list": "node scripts/my-names.js"
  },
  "dependencies": {
    "ethers": "^6.0.0"
  },
  "keywords": ["nad", "monad", "name-service", "web3", "ai-agent", "nns", "registerWithSignature"],
  "license": "MIT"
Confidence
95% confidence
Finding
"ethers": "^6.0.0"

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Content
---
name: NadName Agent
description: "๐ŸŒ Register .nad names on Monad blockchain via Nad Name Service (NNS). Real API integration with registerWithSignature, dynamic gas estimation, permanent ownership."
---

# ๐ŸŒ NadName Agent v2.0 - .nad Names on Monad
Confidence
78% confidence
Finding
description:; โ€; โ€

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.