ClawHub
Back to skill

Security audit

AgentPocket

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly documentation for a local-only agent wallet/payment app, with no bundled executable code, but users should treat its financial and private-key claims as unverified.

Install only with the understanding that this is documentation for a local or not-yet-deployed payments system. Do not use it for real funds, private keys, card payments, or production wallet operations unless you separately inspect the actual server, smart-contract, and deployment code and confirm the public URL's role.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The body text repeatedly states the product is not yet deployed and that there is no public hosted endpoint. However, the manifest metadata advertises a public URL, creating an intent/documentation contradiction about whether a live remote service exists.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The documentation makes a strong behavioral guarantee that private keys are returned once and never stored by the server. In this file, however, there is no code to substantiate that guarantee; the skill only documents externally hosted/local server endpoints. Because the claim is stronger than what is evidenced here, the documentation overstates verified behavior relative to the provided artifact.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.