ClawdVine

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:32 AM UTC
• Version: 1.2.0

Overview

ClawdVine is a disclosed paid video-generation skill, but it deserves Review because it can use a raw EVM private key for USDC payments and onchain identity actions while retaining wallet-linked agent data.

Install only if you intend to let an agent use ClawdVine's payment or identity features. Use a dedicated low-balance Base wallet, never a main wallet key, confirm the exact prompt, model, recipient, chain, and USDC amount before each paid action, and treat agent creation, token launch, margin fees, and onchain profile updates as public durable actions.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Intent-Code Divergence

Low

• Confidence: 92% confidence
• Finding: The script advertises that it checks a $CLAWDVINE token balance, but the hardcoded token address is stored under a differently named constant, creating a strong risk that the script is querying the wrong asset or that users will trust incorrect eligibility results. In a payment- and token-gated skill context, this can cause users or downstream automation to make access or payment decisions based on a different token than expected.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The skill explicitly tells agents to store `agentId` in memory, config, or environment permanently, but does not warn that this identifier can be user-linked and may persist across sessions or contexts. While `agentId` is not a secret like a private key, persistent retention of identity metadata can create unnecessary privacy exposure and accidental cross-user attribution.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: The instruction to permanently save and reuse `agentId` encourages ongoing retention of a user- or wallet-linked identifier across future sessions. In agent environments with shared memory or weak tenancy boundaries, this can cause identity mix-ups, unintended profiling, or use of one user's identity in another user's workflow.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: This section broadens the persistence guidance to multiple values (`agentId`, `creditsBalance`, `mcp.endpoint`, `creator` wallet address) and tells agents to save them 'for every future session.' That creates a clearer retention risk because it includes directly user-linked wallet information and service endpoints that can be reused or exposed beyond the original task context.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"build:tar": "node scripts/build-tar.mjs"
  },
  "dependencies": {
    "@x402/evm": "^2.2.0",
    "@x402/fetch": "^2.2.0",
    "siwe": "^2.3.2",
    "viem": "^2.45.1"

• Confidence: 93% confidence
• Finding: The dependency uses a caret range, which permits automatic installation of newer compatible versions. This increases supply-chain risk because a compromised or breaking upstream release could be pulled in without deliberate review, which is notable here because the skill handles payment-related and wallet-related packages.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

},
  "dependencies": {
    "@x402/evm": "^2.2.0",
    "@x402/fetch": "^2.2.0",
    "siwe": "^2.3.2",
    "viem": "^2.45.1"
  },

• Confidence: 93% confidence
• Finding: The dependency version is not pinned exactly and may resolve to future upstream releases. In a skill that performs x402 payment flows and network requests, this creates a supply-chain exposure where an unexpected dependency update could alter request handling or introduce malicious code.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"dependencies": {
    "@x402/evm": "^2.2.0",
    "@x402/fetch": "^2.2.0",
    "siwe": "^2.3.2",
    "viem": "^2.45.1"
  },
  "repository": {

• Confidence: 94% confidence
• Finding: The siwe package is security-sensitive because it is involved in Sign-In with Ethereum flows, and allowing floating compatible versions increases the chance of silently consuming a vulnerable or malicious upstream release. Since this skill includes signing functionality, compromise of this dependency could affect authentication or message-signing behavior.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"@x402/evm": "^2.2.0",
    "@x402/fetch": "^2.2.0",
    "siwe": "^2.3.2",
    "viem": "^2.45.1"
  },
  "repository": {
    "type": "git",

• Confidence: 94% confidence
• Finding: The viem dependency is also security-sensitive because it is commonly used for wallet, RPC, and transaction interactions. Using a caret range allows unreviewed upstream changes into code that may touch balances, signing, or payment execution, increasing supply-chain and operational risk.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.env_credential_access, suspicious.prompt_injection_instructions

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/check-balance.mjs:22

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/x402-generate.mjs:29

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: SKILL.md:1569