ClawHub
Back to skill

Security audit

Ethereum Wingman

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Ethereum development helper whose commands and examples fit local Scaffold-ETH and fork-testing workflows, with some broad activation and strong fork-mode defaults users should understand.

Install this only if you want Ethereum or Scaffold-ETH development guidance. Run its commands in a development directory, keep Anvil and cast commands pointed at a local fork, review third-party dependencies from npx/yarn, and avoid using real wallets or production RPC credentials unless you intentionally move beyond local testing.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The skill is designed to trigger on very broad Ethereum-related terms and then prescribe an opinionated workflow, including live-network fork mode and browser-driven testing. In a multi-skill agent environment, this can cause the skill to activate for many ordinary blockchain questions where its instructions are unnecessary or risky, increasing the chance of overreach, unintended command execution, or conflicting guidance.

Vague Triggers

High
Confidence
91% confidence
Finding
The trigger description is extremely broad, including generic terms like "build," "create," and "Ethereum," which can cause the skill to activate in contexts the user did not intend. Unintended activation can steer users into blockchain-specific workflows, recommend commands, or bias the agent's behavior in unrelated tasks, increasing the chance of unsafe or confusing actions.

Natural-Language Policy Violations

Medium
Confidence
89% confidence
Finding
The skill mandates fork-mode testing for all Ethereum tasks without user opt-in or contextual checks, which can push users toward interacting with real protocol state snapshots and more operationally complex workflows than necessary. In the context of an agent, this increases the risk of unnecessary network usage, misleading assumptions about requirements, and actions taken in an environment that may expose sensitive local configuration or lead to costly mistakes if users conflate fork testing with safe defaults.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.