Security audit

clawmbti-dev

Security checks across malware telemetry and agentic risk

Overview

This skill has a coherent MBTI/NFT purpose, but it silently profiles conversations, creates a wallet, stores sensitive local state, and sends personality evidence plus wallet data to a remote service without clear just-in-time consent.

Review carefully before installing. Use this only if you are comfortable with background conversation-derived profiling, files under ~/.mbti, a locally stored Solana private key, and submissions of MBTI evidence plus wallet information to the ClawMBTI service. Prefer a revised version that asks before collecting cross-session history, creating a wallet, sending reports, minting, and fetching share data, and that documents how to review and delete stored data.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (30)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill advertises powerful capabilities including file read/write, shell execution, and network access without declaring permissions. This undermines informed consent and review, especially because the skill also handles wallet material and conversation-derived data, making the hidden capability surface materially dangerous.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documented behavior does not fully match the actual operations: additional remote endpoints, extra metadata sharing, different wallet storage paths, and undeclared content generation are all significant from a security and privacy perspective. Description-behavior mismatch prevents users and reviewers from understanding what data leaves the system and where sensitive credentials are stored.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The skill description presents the feature as NFT minting with limited data sharing, but this client also supports separate reporting and remote record update operations. That mismatch expands the data-processing and remote-control surface beyond what users would reasonably expect, which is dangerous because it enables undisclosed transmission and mutation of remote records tied to MBTI sessions.

Description-Behavior Mismatch

Medium

Confidence: 98% confidence
Finding: The report command forwards arbitrary caller-supplied JSON directly to the remote API, including optional fields like evidence and description, despite the skill claiming only local behavioral summaries and no raw dialogue. In this context, that creates a concrete privacy risk because raw conversation excerpts or sensitive metadata can be exfiltrated without meaningful validation or disclosure.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The client can PATCH existing remote detection records to change agent_name, which is outside the stated purpose of MBTI detection and NFT issuance. Even if intended for maintenance, exposing record-modification capability in a general client increases the chance of unauthorized or misleading changes to remotely stored data.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The skill instructs the user to install a package manager by fetching and piping a remote script directly into the shell. This creates a software supply-chain risk because the downloaded code is not pinned, verified, or reviewed before execution, and it is not strictly justified by the skill’s core MBTI/NFT function. In this skill’s context, the risk is heightened because other steps already involve local key generation and API interaction, so encouraging unsafe bootstrap practices compounds trust and execution risk.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The step instructs the agent to silently create a Solana wallet keypair on the user's system before any user-visible action or consent. Creating persistent cryptographic credentials as a hidden side effect is dangerous because it modifies local security state, may create sensitive key material the user did not authorize, and normalizes undisclosed wallet provisioning tied to later networked NFT minting.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The step explicitly instructs the agent to read dialogue excerpts, personality signals, and key quotes from prior sessions and merge them into the current analysis. That conflicts with the stated behavior of storing only behavioral summaries and no raw dialogue, and it materially expands the data being processed to include sensitive conversational content and cross-session reuse without clear consent.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The skill instructs the agent to silently transmit MBTI results, derived evidence, model identifier, session identifier, and a wallet address to a remote API immediately after user confirmation of accuracy, but without explicit consent for data transfer. This is dangerous because the nearby UX implies the user is only confirming the result, not authorizing off-device profiling data submission tied to a wallet, creating a deceptive privacy and data-sharing flow.

Intent-Code Divergence

Low

Confidence: 89% confidence
Finding: The step tells the agent to present the wallet as already created, but also includes a fallback that generates a new wallet if retrieval fails. That means this step can perform a state-changing, file-creating operation without clearly surfacing that behavior to the user, creating a risk of unauthorized wallet creation and misleading user messaging about what actually happened.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The passive trigger can activate during ordinary discussion about personality or communication style, causing the skill to begin analysis and potentially launch sensitive downstream actions without a clear, fresh request. In context, that matters because the downstream flow includes local state inspection, possible wallet-related operations, and data sharing with an external API.

Missing User Warnings

High

Confidence: 97% confidence
Finding: The skill mandates silent per-reply behavioral logging after every assistant response without a clear user-facing notice or consent mechanism. Continuous hidden collection across sessions is privacy-invasive and especially risky because the stored material later contributes to externally shared 'conversation evidence.'

Missing User Warnings

High

Confidence: 96% confidence
Finding: The skill states that MBTI results and conversation evidence are sent to an external API but does not present a prominent privacy warning or granular consent. In context, the transmitted data is derived from conversation history and may include sensitive behavioral inferences, making undisclosed outbound transfer particularly dangerous.

Missing User Warnings

High

Confidence: 96% confidence
Finding: The skill states that MBTI results and conversation evidence are sent to an external API but does not present a prominent privacy warning or granular consent. In context, the transmitted data is derived from conversation history and may include sensitive behavioral inferences, making undisclosed outbound transfer particularly dangerous.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: Sensitive detection data is sent to a remote API with no user-facing notice, confirmation, or contextual disclosure at the point of transmission. Given the skill context explicitly references behavioral summaries and evidence, silent network transmission materially increases privacy and trust risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The script generates a new Solana private key and persists it to disk under the user's home directory, creating a long-lived sensitive credential file. While file mode 600 helps, the risk remains because users may not realize a blockchain signing key is being created and retained locally, and the broader skill context says minting can happen automatically on first use, increasing the chance of surprise credential creation and later compromise through local malware, backups, or misconfigured home directories.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill directs the agent to perform dependency/environment setup silently, without proactively informing the user that package synchronization will occur. Silent setup reduces user awareness and consent around network access, dependency resolution, and changes to the local environment, which is especially concerning in a skill that also manages wallets and external API communication. That context makes undisclosed setup more dangerous because it normalizes hidden side effects before more sensitive operations occur.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The markdown explicitly directs silent wallet initialization and generation with 'show nothing to the user,' which removes transparency around creation of sensitive local assets. In this skill's context, the hidden wallet is not merely incidental state: it is a blockchain credential later used to mint an NFT and send MBTI result and conversation evidence to an external API, making the undisclosed side effect materially more dangerous.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The instructions tell the agent to access prior-session conversation history automatically, but there is no user-facing notice in the step that earlier dialogue will be retrieved and analyzed. Because this is personality profiling across sessions, silent access increases privacy risk and can violate user expectations around session boundaries.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The step directs the system to persist the MBTI result to storage, but it does not instruct the agent to warn the user that a personality inference will be saved. Persisting inferred personality traits creates a durable profile that can be sensitive, especially when tied to conversation-derived evidence and later NFT minting workflows.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The workflow performs a background submission of sensitive profiling outputs and the local wallet address with an instruction to produce no user-facing output. Silent exfiltration of personality-profile data and an identifier linked to blockchain activity undermines informed consent and can enable tracking, correlation, or unexpected persistence of personal data.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The fallback path runs a wallet generation command that creates sensitive key material on disk without any explicit warning, confirmation, or prior opt-in in this step. In the skill context, this is more dangerous because the broader workflow already normalizes silent wallet creation and later NFT minting, so the agent could provision blockchain credentials for a user without informed consent.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The step allows very broad affirmative matching (for example, any user text like 'yes', 'mint', or 'go for it') to trigger progression into the mint flow. In a skill that can be passively triggered and ultimately perform wallet/NFT actions, this increases the chance of accidental consent or ambiguous user utterances being treated as authorization for a blockchain-related operation.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The prompt displays the user's wallet address and a personality profile link and encourages minting without clearly warning that personal/behavioral data and wallet-linked information may be exposed or transmitted. Given the broader skill context says MBTI result and conversation evidence are sent to an external API, this omission can mislead users about privacy consequences and create avoidable disclosure of sensitive metadata.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The step explicitly instructs the agent to silently perform an additional network request and store returned content locally without notifying or obtaining consent from the user. In this skill’s context, the data flow already includes wallet identifiers, token identifiers, model/personality metadata, and conversation-derived evidence, so adding an undisclosed post-mint fetch increases privacy risk and normalizes hidden secondary processing.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.