ClawHub
Back to skill

Security audit

x402lint

Security checks across malware telemetry and agentic risk

Overview

The skill is a transparent x402 conformance scanner guide with paid wallet-enabled options that are disclosed, but users should treat the optional wallet private key with care.

Use the free endpoints first. If enabling paid MCP tools, use a dedicated low-balance wallet, keep EVM_PRIVATE_KEY out of source control and logs, verify the x402lint-mcp npm package/source before granting it a funded key, and rotate the key if it may have been exposed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill instructs users to supply an `EVM_PRIVATE_KEY`/`PRIVATE_KEY` for the MCP server but does not explicitly warn that this is a highly sensitive secret requiring secure storage, least-privilege funding, and careful handling. In an agent-skill context, omission of such guidance increases the chance users place a spend-capable blockchain key directly into configs, logs, shells, or untrusted environments, leading to wallet compromise or unauthorized spending.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.