ClawHub
Back to skill

Security audit

MintGarden

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward public MintGarden API client with dependency and privacy-disclosure cautions, but no evidence of hidden or harmful behavior.

Install only if you are comfortable sending MintGarden searches, wallet/profile identifiers, and NFT or collection IDs to the public MintGarden API. For production or shared environments, update and re-lock the HTTP dependencies first and treat profile or wallet lookups as privacy-sensitive public-chain data.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (10)

Known Vulnerable Dependency: axios==1.13.4 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High
Category
Supply Chain
Confidence
95% confidence
Finding

The lockfile pins axios 1.13.4, and the provided advisory set includes multiple high-severity issues affecting request handling, proxy behavior, and potential prototype-pollution-related exploitation paths. In a skill package, an HTTP client is a security-sensitive dependency because it commonly processes untrusted URLs, headers, redirects, and proxy settings, so vulnerable behavior can directly enable SSRF, credential leakage, or response manipulation.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High
Category
Supply Chain
Confidence
86% confidence
Finding

form-data 4.0.5 is reported as vulnerable to CRLF injection through unescaped multipart field names or filenames. If the skill builds multipart requests using attacker-influenced values, an attacker may be able to tamper with request structure or inject unintended headers/content, which can lead to request smuggling-style effects or downstream parser abuse.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.13.4 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High
Category
Supply Chain
Confidence
87% confidence
Finding

The declared range ^1.6.0 can resolve to later 1.x axios releases, and the static analysis indicates resolution to a version with multiple published advisories. Because this skill is explicitly built to browse and analyze data via the MintGarden API, it likely performs outbound HTTP requests; vulnerable HTTP client behavior can enable SSRF, proxy bypass, credential leakage, or response manipulation depending on how requests are constructed and where the skill runs.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 15)May include surrounding context.

md
<a href="https://nodejs.org/">
    <img src="https://img.shields.io/badge/Node.js-v18+-green.svg" alt="Node.js: v18+">
  </a>
  <a href="https://api.mintgarden.io/docs">
    <img src="https://img.shields.io/badge/API-MintGarden-blue.svg" alt="MintGarden API">
  </a>
  <a href="https://clawd.bot">

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 368)May include surrounding context.

md
<a href="https://nodejs.org/">
    <img src="https://img.shields.io/badge/Node.js-v18+-green.svg" alt="Node.js: v18+">
  </a>
  <a href="https://api.mintgarden.io/docs">
    <img src="https://img.shields.io/badge/API-MintGarden-blue.svg" alt="MintGarden API">
  </a>
  <a href="https://clawd.bot">

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 207)May include surrounding context.

md
<a href="https://nodejs.org/">
    <img src="https://img.shields.io/badge/Node.js-v18+-green.svg" alt="Node.js: v18+">
  </a>
  <a href="https://api.mintgarden.io/docs">
    <img src="https://img.shields.io/badge/API-MintGarden-blue.svg" alt="MintGarden API">
  </a>
  <a href="https://clawd.bot">

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The markdown describes tracking NFT ownership, trade history, profiles, and portfolios, and later shows commands for querying user profiles and activity, but it does not warn users that these lookups surface potentially privacy-sensitive third-party activity data. For a markdown skill description, this is a missing disclosure about behavior that can affect privacy expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

This code sends user-provided search terms to an external API via api.search(query, { limit: 20 }), but there is no confirmation prompt, visible disclosure, or warning in this file that user input will be transmitted off-box. Similar undisclosed network calls occur throughout the command handlers, so users may not realize their queries and identifiers are being sent to a remote service.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: follow-redirects==1.15.11 — 1 advisory(ies): CVE-2026-40895 (follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta)

Low
Category
Supply Chain
Confidence
88% confidence
Finding

follow-redirects 1.15.11 is flagged for leaking custom authentication headers across cross-domain redirects. In a skill that makes outbound HTTP requests, this can expose API keys, bearer tokens, or internal auth headers to attacker-controlled endpoints if redirects are followed automatically.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The dependency uses a caret range ("^1.6.0"), which permits automatic installation of newer 1.x releases instead of a single vetted version. In a security-sensitive supply chain context, this increases exposure to unexpected upstream changes or newly introduced vulnerable releases, especially because the package is a CLI skill that may be installed by others.

Content

Scanner excerpt · package.json (reported line 23)May include surrounding context.

json
"author": "Jeff Coleman",
  "license": "MIT",
  "dependencies": {
    "axios": "^1.6.0"
  },
  "engines": {
    "node": ">=18.0.0"

Static analysis

No suspicious patterns detected.