ClawHub
Back to skill

Security audit

Xian SDK

Security checks across malware telemetry and agentic risk

Overview

This is a documentation skill for the Xian Python SDK; its blockchain transaction examples require caution but are disclosed and purpose-aligned.

Install only if you need Xian SDK development help. Treat transfer, approve, swap, send_tx, and submit_contract examples as real on-chain actions when connected to a live wallet or production node; use test wallets/testnets first, protect private keys and mnemonics, verify addresses and amounts, and add explicit confirmation before broadcasting transactions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
The upgradeable proxy example shows dynamic module loading via `importlib.import_module()` and arbitrary function dispatch via `getattr()` on user-influenced values. In documentation for a blockchain SDK, this can normalize an unsafe pattern that enables execution of unintended contract code paths, weakens auditability, and can become a code-execution or privilege-boundary issue if reused in agentic or off-chain contexts.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill includes ready-to-run examples for sending transactions, approving token spending, swapping assets, and deploying contracts without prominently warning that these actions are irreversible, may consume fees, and can lead to permanent loss of funds if run against a real wallet or production node. In an agent-skill context, users may copy or adapt snippets directly, so omission of safety guidance materially increases the chance of accidental on-chain actions.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.