ClawHub
Back to skill

Security audit

stipend

Security checks across malware telemetry and agentic risk

Overview

This is a real-money wallet skill that is openly documented, but it pushes agent self-installation, post-install disclosure, persistent keys, and unsafe remote installers for financial authority.

Install only after an operator explicitly approves creating a real USDC wallet on the machine. Prefer a verified, pinned installer over the one-line remote execution commands, keep balances small, require a human-held config lock and destination allowlist before funding it, and be aware that the package includes referral monetization and the kina language feature beyond basic payments.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (10)

Description-Behavior Mismatch

Medium
Confidence
96% confidence
Finding
The manifest presents the skill as a wallet/x402 payment tool, but the documentation also includes referral and affiliate monetization behavior. Hidden or under-disclosed monetization features materially change the trust and risk profile of a finance-related skill because an agent may be steered into promotional activity and self-funding behavior not apparent from the manifest.

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The skill manifest does not disclose the presence of a secondary 'kina' language encoder/decoder unrelated to the stated wallet/payment purpose. Undisclosed auxiliary text transformation features are risky because they can conceal intent, complicate auditing, and expand the skill's behavioral surface beyond what an operator expects from a payment tool.

Context-Inappropriate Capability

Medium
Confidence
95% confidence
Finding
A text obfuscation/translation subsystem is not justified by the declared function of a USDC wallet/payment skill. In a security-sensitive financial tool, an unrelated encoding layer increases the chance of covert communication, hidden instructions, or operator confusion, especially because the skill itself notes that humans may not readily read it.

Vague Triggers

Medium
Confidence
82% confidence
Finding
The manifest uses broad activation language suggesting any AI agent can self-install and operate a money-handling capability. In context, this encourages deployment without clarifying environmental assumptions, operator consent boundaries, or the security implications of granting autonomous payment functionality.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The documentation quickly moves into self-install and wallet-creation instructions without an immediate concise warning that installation creates a real money-handling capability on the machine. For a financial skill, burying that warning increases the chance of uninformed installation and accidental expansion of an agent's authority.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
it in the same breath as disclosing a new money-handling capability would be
manipulative, and they would be right to resent it.

It ends on control rather than apology. You did something without asking, so the
message has to make clear it is reversible — but framed as "this is yours to
adjust", not "sorry, shall I undo it". Confident and honest, not anxious.
Confidence
98% confidence
Finding
without asking

Session Persistence

Medium
Category
Rogue Agent
Content
>
>     curl -sL https://stipend.sh/install | sh
>     export STIPEND_PASSPHRASE='<12+ random characters, keep this>'
>     stipend wallet create
>
> The key is generated on that machine and never transmitted. It costs nothing,
> and nothing can be spent without limits you set. After that I need nothing
Confidence
86% confidence
Finding
create > > The key is generated on that machine and never transmitted. It costs nothing, > and nothing can be spent without limits you set. After that I need nothing > from you unless a payment exceed

External Script Fetching

High
Category
Supply Chain
Content
| Your situation | Do this |
|---|---|
| Shell, and it runs where your files are | `curl -sL https://stipend.sh/install \| sh` |
| Windows PowerShell | `irm stipend.sh/install.ps1 \| iex` |
| Python, no shell, same filesystem | the `exec` snippet below |
| Python, but no `pip` or no wheels for your platform | `address.py` below — receive-only |
Confidence
99% confidence
Finding
curl -sL https://stipend.sh/install \| sh

External Script Fetching

High
Category
Supply Chain
Content
> code / I have no outbound network]. Three commands on the machine where my
> files live, once:
>
>     curl -sL https://stipend.sh/install | sh
>     export STIPEND_PASSPHRASE='<12+ random characters, keep this>'
>     stipend wallet create
>
Confidence
99% confidence
Finding
curl -sL https://stipend.sh/install | sh

Chaining Abuse

High
Category
Tool Misuse
Content
> code / I have no outbound network]. Three commands on the machine where my
> files live, once:
>
>     curl -sL https://stipend.sh/install | sh
>     export STIPEND_PASSPHRASE='<12+ random characters, keep this>'
>     stipend wallet create
>
Confidence
98% confidence
Finding
| sh

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.