ClawHub
Back to skill

Security audit

Deploy Contracts

Security checks across malware telemetry and agentic risk

Overview

This skill is instruction-only and purpose-aligned, but it includes mainnet Aptos deployment and upgrade commands that can bypass confirmation using the user's local signing profile.

Install only if you are comfortable with an agent surfacing Aptos CLI deployment commands. Before any mainnet deploy or upgrade, avoid `--assume-yes`, explicitly verify the Aptos profile, signer address, network, package, object address, and gas cost, and keep private keys out of prompts and logs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger phrase "how to deploy" is overly generic and can cause this high-priority skill to activate during ordinary conversation that is not specifically about Aptos Move contract deployment. In an agent setting, broad unintended activation increases the chance that deployment-oriented instructions or risky operational guidance are surfaced in the wrong context.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
# 1. Gas confirmation: Review gas costs
# 2. Object address: Note the object address for future reference

# OR use --assume-yes to auto-confirm (only if you're confident)
aptos move deploy-object \
    --address-name my_addr \
    --profile default \
Confidence
88% confidence
Finding
auto-confirm

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
--object-address <object_address_from_initial_deploy> \
    --profile mainnet

# Upgrade with auto-confirm
aptos move upgrade-object \
    --address-name my_addr \
    --object-address <object_address> \
Confidence
84% confidence
Finding
auto-confirm

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.