ClawHub
Back to skill

Security audit

xbridge-ext-helper

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only developer helper for xbridge3 extension fields, with production-code caveats but no evidence that it runs code or accesses data itself.

Reasonable to install as developer documentation. Before reusing the Java examples in a real financial system, remove full transaction payload logging, restore or redesign audit-history handling, and add validation/tests around extension-field save/load behavior.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Intent-Code Divergence

Medium
Confidence
96% confidence
Finding
The code and comments state that original transactions should be persisted to history before discount calculation to satisfy audit-trail requirements, but the actual calls are commented out in both create and update paths. This creates an integrity and non-repudiation gap: a user can modify or replace transaction data without preserving the original state, undermining auditability and potentially enabling fraud or compliance violations.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The processor logs the full serialized transaction object after discount handling, which can expose sensitive business or personal data in application logs. If logs are accessible to operators, support staff, or downstream log systems, this can lead to unauthorized data disclosure and broaden the blast radius of any log compromise.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.