ClawHub
Back to skill

Security audit

trongrid-account-profiling

Security checks across malware telemetry and agentic risk

Overview

This skill provides disclosed TRON wallet profiling using public on-chain data, with privacy-sensitive but purpose-aligned behavior.

Install this only if you want the agent to aggregate and interpret public TRON address activity. Treat wallet addresses as privacy-sensitive, especially if they can be linked to a person, and prefer a simpler lookup flow when you only need a basic balance.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The skill description is broad enough to trigger on common wallet-related requests, which can cause the agent to invoke detailed blockchain profiling when a user may only want a simple balance lookup. In this context, overbroad activation increases the chance of unnecessary collection, correlation, and presentation of sensitive behavioral data from on-chain activity.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly supports detailed account profiling, transaction-pattern analysis, whale tracking, and DeFi participation inference, but provides no privacy notice or use-limiting guidance. Even though blockchain data is public, aggregating and classifying it into a behavioral profile meaningfully increases privacy risk and can facilitate surveillance, doxxing, or targeted exploitation of high-value accounts.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal