ClawHub
Back to skill

Security audit

clawchain plugin for impossible finance

Security checks across malware telemetry and agentic risk

Overview

This skill is openly for crypto trading, but it gives the agent persistent control of a real BSC wallet without clear per-trade confirmation safeguards.

Install only if you are comfortable giving the agent control of a dedicated, low-value BSC wallet. Protect the wallet file, do not reuse a wallet with important funds, verify arbitrary token addresses independently, and require a clear quote plus your explicit approval before every approval or swap.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill instructs an agent to hold a private key and perform irreversible on-chain swaps, but it does not clearly require explicit user confirmation, risk acknowledgment, or prominent warnings about permanent fund loss from mistaken addresses, slippage, approvals, or malicious token contracts. In an autonomous agent context, omission of these safeguards increases the chance of unintended financial loss.

Scope Creep

Low
Category
Excessive Agency
Content
# Impossible Finance Trading Skill

This skill lets the AI agent create a BSC wallet (private key + address saved in one file), **discover which tokens and swaps are available** on Impossible Finance DEX, swap tokens, and receive top-ups from the user. The agent is not limited to specific tokens — it can resolve token addresses and check which pairs have liquidity.

Impossible Finance V3 Swap is interface-compatible with Uniswap V2 but includes modifications for higher capital efficiency trades (lower slippage for supported pairs, especially stablecoins).
Confidence
73% confidence
Finding
not limited to

Session Persistence

Medium
Category
Rogue Agent
Content
# Impossible Finance Trading Skill

This skill lets the AI agent create a BSC wallet (private key + address saved in one file), **discover which tokens and swaps are available** on Impossible Finance DEX, swap tokens, and receive top-ups from the user. The agent is not limited to specific tokens — it can resolve token addresses and check which pairs have liquidity.

Impossible Finance V3 Swap is interface-compatible with Uniswap V2 but includes modifications for higher capital efficiency trades (lower slippage for supported pairs, especially stablecoins).
Confidence
96% confidence
Finding
create a BSC wallet (private key + address saved in one file), **discover which tokens and swaps are available** on Impossible Finance DEX, swap tokens, and receive top-ups from the user. The agent is

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal