ClawHub
Back to skill

Security audit

Xian Node

Security checks across malware telemetry and agentic risk

Overview

This skill is purpose-aligned for running Xian blockchain nodes, but it gives high-impact validator key, reset, and transaction examples without enough safety warnings.

Install only if you are comfortable managing blockchain node infrastructure. Treat validator private keys as high-value secrets, avoid command history or chat exposure, back up keys and configuration before wipe/reset operations, and test transaction examples only on local or test networks unless you intentionally want to move real funds.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (4)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill shows passing a validator private key directly on the command line without warning that shell history, process lists, logs, or terminal recordings may expose it. In a blockchain validator context, compromise of this key can allow node impersonation or validator identity takeover, making the context especially sensitive.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The example generates a validator private key and prints it to stdout, which risks exposure through terminal scrollback, shell logging, remote session capture, CI logs, or copied transcripts. Because this is a validator key for a blockchain network, disclosure can lead to permanent compromise of the validator identity and associated funds or staking authority.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The documented reset commands can wipe node data and reinitialize state, but the skill does not clearly warn about irreversible data loss or operational disruption. In node-management context this can erase local blockchain data, require lengthy resynchronization, and potentially remove locally stored configuration or validator-related state if users misunderstand the scope.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The transaction example includes code that can send funds on a live node without warning the user that it performs a state-changing financial action. In a blockchain skill, users may copy-paste examples directly, so omission of a warning increases the risk of accidental transfers, use of real keys, or unintended execution against mainnet.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.