ClawHub
Back to skill

Security audit

Bonero-Miner

Security checks across malware telemetry and agentic risk

Overview

The skill openly teaches cryptocurrency mining, but its default install runs an unpinned remote script and its mining command starts a detached CPU-consuming daemon.

Install only if you intentionally want this machine to mine Bonero. Prefer downloading and inspecting the installer, pinning a trusted release or commit, limiting CPU threads, monitoring power and CPU load, stopping the daemon when finished, and keeping wallet seed phrases out of chats or shared files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
99% confidence
Finding
The skill instructs users to execute a remote install script directly via `curl | bash`, which bypasses meaningful review and allows immediate execution of whatever content is served at that URL at run time. In this context, the script installs and configures cryptocurrency-mining software, so compromise of the repository, maintainer account, or delivery path could lead to arbitrary code execution and unauthorized resource use on the host.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.