ClawHub
Back to skill

Security audit

Maiat Trust API

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent trust API guide, but it tells agents to send wallet-linked outcome and threat reports that can affect reputation or blocking without enough user-control guidance.

Install only if you are comfortable sending wallet-linked trust, token, outcome, and threat-report data to Maiat. Require explicit user approval before registration, outcome reporting, or threat reporting, and review the optional wallet-guard npm package before giving it transaction authority.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Vague Triggers

Medium
Confidence
85% confidence
Finding
The description and usage guidance are broadly framed around common agent tasks like verifying counterparties and establishing identity, which can cause over-invocation without clear consent or policy boundaries. In a trust/transaction skill, this increases the chance that agents send wallet identifiers or query third-party profiles automatically in situations where users did not explicitly approve external reputation checks.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The decision tree uses natural-language triggers like 'I need to VERIFY another agent' and 'I want to PROTECT my wallet transactions' without constraints, approval checkpoints, or disallowed cases. That makes the skill easy for an orchestration layer to invoke opportunistically, potentially causing unsolicited third-party lookups, transaction gating, or registration actions tied to wallets and addresses.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The outcome reporting section instructs agents to 'always' report job outcomes and include a reporter wallet, but it does not warn that this sends wallet-linked behavioral data to an external service. Because the report links a wallet to a prior query and transaction outcome, it can expose interaction history and create privacy, profiling, and governance risks if done automatically.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The threat reporting workflow encourages submitting third-party addresses and states that 3+ independent reports trigger automatic blocking across protected agents, but it omits warnings about false reports, due process, and downstream automated enforcement. In a trust network, this can enable reputational harm or denial-of-service against legitimate addresses if agents report aggressively or on weak evidence.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal