Security audit

CLAWP

Security checks for vulnerabilities and agentic risk

Overview

This skill is not malicious code, but it guides users toward real cryptocurrency token launch actions without enough risk disclosure or control details.

Review before installing. Use this only if you understand it may lead to real Solana spending and irreversible token-launch actions. Do not deposit funds or approve deployment unless wallet addresses, network, fees, automation rules, buyback/burn behavior, and loss risks are clearly shown and explicitly confirmed outside the skill.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

High

Confidence: 96% confidence
Finding: The conversation flow explicitly instructs the user toward a 0.025 SOL deposit but does not prominently warn that this involves real funds, blockchain transactions may be irreversible, and losses or scams may occur. In the memecoin-launch context, this is especially dangerous because users may treat the agent's guidance as trusted operational instruction and send funds without understanding financial risk or finality.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The conversation flow states that after user confirmation, deployment proceeds through fixed mechanics and that buyback and burn actions occur automatically post-launch, but it does not present a clear warning about irreversible on-chain actions, fees, custody implications, or financial risk. In a token-launch skill, describing automated execution without prominent risk disclosure and explicit informed consent can mislead users into triggering real transactions or economic actions they do not fully understand.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The README explicitly describes automatic token deployment and post-launch buyback/burn actions, which are irreversible financial or asset-affecting operations, but it does not clearly warn users about the risks, authorization requirements, or possible loss of funds. In a skill whose purpose is autonomous meme-token launch coordination, omission of explicit user-consent and risk language can mislead operators into triggering sensitive actions without understanding consequences.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The skill is broadly framed as a token-creation advisor and its conversation flow lacks explicit activation boundaries, so it could be invoked in contexts beyond harmless ideation and drift into actionable launch or promotional guidance. In a crypto setting, unclear scope increases the chance the agent provides risky operational or quasi-financial assistance without adequate gating, disclosures, or user-intent checks.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The prompt is framed broadly around turning a user idea into a token launch blueprint with minimal interaction, but it does not define strong activation boundaries or refusal conditions for unsafe, deceptive, or regulated token requests. In a crypto-launch context, ambiguous invocation increases the chance the agent will engage on risky prompts by default and generate operationally actionable content without sufficient screening.

Static analysis

No suspicious patterns detected.