ClawHub
Back to skill

Security audit

marsbit-crypto-news-skill

Security checks across malware telemetry and agentic risk

Overview

This appears to be a coherent crypto-news skill that uses curl to query MarsBit's hosted MCP service, with no evidence of hidden persistence, credential theft, or destructive behavior.

Install this if you are comfortable sending crypto-news queries to MarsBit's hosted service. Do not include secrets, private trading plans, customer data, or proprietary internal context in prompts that use this skill.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly instructs the agent to send user queries to a third-party hosted MCP endpoint via curl, but it provides no warning that prompts, keywords, or article lookup parameters will leave the local environment. This creates a real data-exposure risk if users ask sensitive questions or include proprietary context, especially because the workflow normalizes direct remote transmission as the default behavior.

External Transmission

Medium
Category
Data Exfiltration
Content
---
name: marsbit-crypto-news-skill
description: Crypto-native Web3 news and flash intelligence from MarsBit through hosted MCP. Use this for L1/L2 ecosystems, DeFi/CeFi, regulation, exchange flows, and market-moving events.
metadata: {"openclaw":{"emoji":"📰","requires":{"bins":["curl"]},"install":[{"id":"curl","kind":"brew","formula":"curl","label":"curl (HTTP client)"}],"os":["darwin","linux","win32"]},"version":"0.3.2"}
---

# MarsBit Crypto News Skill (Web3-focused)
Confidence
86% confidence
Finding
curl (HTTP client)"}],"os":["darwin","linux","win32"]},"version":"0.3.2"} --- # MarsBit Crypto News Skill (Web3-focused) This skill is designed to work immediately after installation using the hoste

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.