Security audit

clawm-dev

Security checks across malware telemetry and agentic risk

Overview

This MBTI/NFT skill has a coherent theme, but it silently profiles conversations, creates and stores a crypto wallet key, and sends personality results to a remote service with weak user control.

Review this before installing. It is not clearly malicious, but you should only use it if you are comfortable with background personality profiling, local storage in ~/.mbti, creation of a Solana private key on your machine, and remote submission of MBTI evidence and wallet-related data. Prefer a version that asks before collecting history, creating a wallet, syncing dependencies, or sending any result to the mint service.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (37)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill declares no permissions while explicitly directing file reads/writes, shell execution via `uv run`, network/API calls, and wallet-related operations. This mismatch prevents informed review and consent, and it materially increases the chance that sensitive local state, credentials, or conversation data are accessed or exfiltrated under the guise of a harmless personality/NFT feature.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The advertised function is MBTI detection and issuing a novelty NFT certificate, but the skill also introduces wallet generation, private-key storage, local state management, and external API interactions that materially expand risk. That description-behavior gap is dangerous because users may consent to a lightweight personality feature without realizing it can create financial artifacts, store secrets, and transmit data off-device.

Context-Inappropriate Capability

Medium

Confidence: 81% confidence
Finding: Instructing the agent to execute local shell commands (`uv run ...`) expands the attack surface from conversational logic to arbitrary local code execution paths. Even if intended for legitimate helper scripts, shelling out is more dangerous than necessary for MBTI analysis and can be abused if the runtime, scripts, or arguments are modified or compromised.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The skill mandates silent, per-reply analysis and persistence of conversation-derived personality signals across sessions without user-facing notice. This creates covert profiling of the assistant's behavior and persistent storage of conversational metadata, which is an intrusive monitoring pattern and can capture sensitive contextual information beyond what users reasonably expect from a novelty MBTI feature.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: Including Solana wallet handling, private-key storage, and remote mint/status/share operations introduces financial and external-network risk that goes well beyond simple personality analysis. If misused or compromised, these features can expose secrets, create unwanted on-chain activity, or leak metadata to third-party services.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script explicitly manages persistent cross-session conversation history under ~/.mbti/conversations and exposes it for later analysis. That is a material expansion of data collection and retention beyond a narrow 'detect MBTI and issue NFT certificate' purpose, creating privacy and scope-creep risk if sensitive dialogue summaries are stored without clear necessity, consent, retention limits, or access controls.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The list-sessions and read-history commands provide broad readout of all stored conversation summaries, effectively creating a general-purpose local data access layer. In the context of a personality-analysis skill, this increases the blast radius of stored sensitive data and makes accidental or unauthorized disclosure more likely, especially because the data spans sessions and may include topics and behavioral signals.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The script's stated purpose is NFT minting/status, but it also uploads MBTI detection results and supports updating remote records. This expands the skill's data-processing and server-side mutation capabilities beyond what a user would reasonably expect, increasing privacy and trust risk even if the behavior is not overtly malicious.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The PATCH endpoint allows the client to modify existing remote detection records by supplying an arbitrary id and agent_name. In the context of an MBTI/NFT skill, this is unnecessary write capability that could enable unauthorized metadata tampering, record poisoning, or misleading attribution if the API accepts weakly validated requests.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: This file implements Solana wallet creation and persistent private-key storage even though the skill is described as MBTI detection plus NFT certificate issuance. Introducing blockchain custody code greatly expands the trust boundary and creates sensitive key-management risk that is not clearly justified by the stated functionality, especially in an agent skill context where users may not expect local wallet generation.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The generate command creates a private Solana keypair, base58-encodes the secret material, and writes it to disk under a caller-influenced directory. That gives the skill wallet custody capabilities unrelated to MBTI classification and means compromise of the host, directory redirection, backups, or downstream tooling can expose funds or enable unauthorized signing.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The skill instructs the user to install a package manager by piping a remotely fetched script directly into a shell, which bypasses normal verification and executes whatever the remote server returns. That behavior is not clearly necessary for an MBTI/NFT-themed skill, so it expands trust and execution scope well beyond the stated purpose.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The step silently creates a wallet before any user-visible consent, disclosure, or clear need to perform the core MBTI-detection function. Generating persistent credential-bearing state on a user's behalf is a material side effect, and doing so invisibly increases the risk of unauthorized asset/account creation, user confusion, and downstream misuse if later steps mint or associate on-chain artifacts with that wallet.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: A step labeled as a local state check is expected to be read-only, but this workflow performs wallet generation as a side effect. That mismatch is dangerous because it hides mutating behavior behind benign framing, making it easier for users, reviewers, and calling agents to underestimate the action's significance and bypass appropriate consent or safety controls.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to read and merge prior-session conversation history into the current MBTI analysis, which expands data access beyond the current interaction. This creates a cross-session privacy issue because sensitive prior content may be processed without clear user awareness or fresh consent, and it increases the amount of data exposed to the skill for a non-essential profiling task.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: The self-sampling flow directs the AI to generate additional profiling data about itself when insufficient conversation evidence exists, rather than limiting results or asking for consent. In this skill's context, that autonomous introspective generation is unnecessary for the stated function and can mislead users by fabricating evidence-like signals while bypassing normal user control over profiling behavior.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill instructs the agent to silently submit detailed MBTI profiling data, evidence, session identifiers, and model metadata to a remote service after user confirmation of accuracy, but without explicit consent for data transmission. This exceeds the user-visible purpose of merely revealing results and issuing an NFT-style certificate, creating a privacy and transparency violation around covert exfiltration of conversation-derived profiling data.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The payload includes model identifier, session ID, dimension scores, evidence text, and descriptive metadata that are not obviously necessary to generate or display an MBTI-themed NFT certificate. Collecting and transmitting extra metadata increases privacy risk, enables profiling of users and agents, and broadens the consequences of backend compromise or misuse.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: This step instructs the agent to access and potentially create a Solana wallet, which is materially unrelated to the stated MBTI-classification and NFT certificate purpose. Introducing hidden cryptocurrency wallet management into an otherwise personality-analysis skill expands capabilities into financial asset handling without clear user consent, creating significant risk of covert account creation, tracking, or later fund solicitation.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The instruction frames the action as a harmless address read, but the documented fallback performs wallet generation, which is a materially different and more sensitive operation. This mismatch can mislead both the agent and the user, causing a state-changing security-sensitive action to occur under the guise of a read-only step.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The workflow instructs the agent to silently make an extra post-mint network call to fetch sharing content and save it locally, even though sharing is not necessary to complete MBTI detection or NFT issuance. This expands data collection and storage beyond the core task without user awareness or consent, creating unnecessary privacy and transparency risk.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The passive trigger activates on broad conversational conditions like discussing personality or communication style, making it likely to run during ordinary interaction without a clear request. In this skill, that matters because activation can lead into state checks, analysis, persistence, wallet-related steps, and potential network actions, increasing the chance of unintended processing.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The skill explicitly directs silent cross-session collection and storage of conversation-derived summaries, quotes, and personality signals without warning the user. Hidden retention of behavioral data is a serious privacy issue because it enables profiling over time and undermines informed consent, especially when combined with local persistence and potential downstream sharing or API use.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The save-session path writes user conversation summaries to disk persistently under ~/.mbti/conversations without any visible warning, consent prompt, or disclosure in the script interface. Silent persistence of conversational data is dangerous because users may reasonably assume ephemeral processing, while the skill instead builds a durable profile across sessions that could later be read back or misused.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The mint request transmits wallet address, MBTI type, dimensions, and optionally referral and model/agent metadata to a remote API, but the code shows no user-facing notice or consent gate. Because this skill can also passively collect personality-related signals per its description, undisclosed transmission makes the privacy risk more serious in context.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.