ClawHub
Back to skill

Security audit

Evk Live Borrow Proof

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed crypto testing skill that can perform real on-chain borrow proof transactions only when live mode and its safeguards are deliberately enabled.

Install only if you intend to let an agent help validate EVK borrowability. Run preview mode first, use a dedicated low-value wallet, keep signer keys out of committed files, verify every contract address, amount, router, and slippage limit, and use live mode only when you intentionally want real on-chain transactions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
97% confidence
Finding
The file requires an operator acknowledgement before live signing, but the value is only a placeholder string and does not define the exact phrase, approval scope, or conditions under which a live transaction is permitted. In a skill explicitly designed to perform tiny live canary borrows on Arbitrum, this ambiguity weakens the human-in-the-loop safeguard and can allow accidental or socially engineered approval of real onchain actions.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.