Clawdentials Escrow

• Analyzed: May 15, 2026, 3:18 AM
• Findings: 1
• Version: 0.1.0
• Hash: a73ceef31b16631e4f77cfa9b4dfe3f272ec209bcb7682a532f64189044561eb
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is suspicious due to several high-risk capabilities. It explicitly instructs the AI agent to execute an external npm package (`npx clawdentials-mcp`) in `SKILL.md` and `references/api.md`, posing a significant supply chain risk. Furthermore, the agent is instructed to handle and 'save' sensitive credentials, including an `apiKey` and a `nsec` (Nostr secret key, a private key), as detailed in `SKILL.md`. The skill also enables the agent to perform financial transactions, such as depositing and withdrawing cryptocurrency, which are high-risk operations.