Skillv0.1.1

ClawScan security

On-Chain Skill Audit · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

SuspiciousFeb 11, 2026, 9:29 AM

Verdict: suspicious
Confidence: medium
Model: gpt-5-mini
Summary: The skill's stated purpose (an on‑chain provenance registry) matches its instructions in broad strokes, but the runtime instructions expect access to local files, an on‑chain signer/wallet and token holdings, and to publish content on‑chain — none of which are declared or constrained — so there are privacy and provenance risks you should understand before using it.
Guidance: Before installing or running this skill, consider the following: (1) it will read local skill.md files you point it at and can publish full reports on-chain — do not register or inscribe content you don’t want public; (2) the SKILL.md expects npm packages and a Solana signer/IQ token but the skill metadata does not declare them — confirm how the agent will obtain signing capability (never supply private keys unless you understand and trust the process); (3) ask the publisher for an explicit install guide and a privacy statement about what gets inscribed to chain and where ZeroLeaks/codeIn upload data; (4) verify the referenced program ID and npm package names independently (typosquatting is possible); (5) if you only want to read registry data, prefer read-only operations and avoid giving signer access or running inscription steps.

Review Dimensions

Purpose & Capability: noteThe skill claims to be an on‑chain provenance/audit registry on Solana, and the SKILL.md describes read/write operations to on‑chain tables and hashing of skill.md content — this is coherent with the stated purpose. However, the instructions reference npm packages (@rocketlabs/skill-audit, @iqlabs-official/solana-sdk, @solana/web3.js) and require a Solana signer/wallet and IQ token holdings for certain writes; none of these dependencies or credentials are declared in the skill metadata. That mismatch should be clarified.
Instruction Scope: concernRuntime instructions tell the agent to read arbitrary local files (register-skill <path> reads skill.md at the given path) and to optionally 'inscribe full report via codeIn' (which would publish full content on-chain/publicly). They also reference running an external tool (ZeroLeaks) without specifying where it runs or what it sends. Reading arbitrary user filesystem paths and publicly inscribing content are both high‑sensitivity actions that the skill does not explicitly disclose or restrict.
Install Mechanism: noteThere is no install spec (instruction-only), which limits what gets written to disk by the skill itself — a low‑risk model. However, the SKILL.md depends on specific npm packages and a Buffer monkey‑patch; because no install steps are provided, the agent/user must already have these packages and environment patches present. That implicit dependency should be declared or an install mechanism provided.
Credentials: concernThe skill metadata declares no required environment variables or credentials, but the instructions clearly require a Solana connection plus a signer/wallet (and IQ token holdings) to perform register/audit/vouch writes. This is a substantive mismatch: writes will require signing capability and potentially access to a wallet/private key. The skill should explicitly declare what credentials it needs and how signing is performed, because signing transactions can publish private data or spend SOL/tokens.
Persistence & Privilege: okThe skill is not flagged as always:true and doesn't request persistent agent privileges. It is user‑invocable and can be run autonomously (default), but that is normal; nothing in the metadata indicates it will modify other skills or system settings.