ClawHub
Back to skill

Security audit

Spacescan

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed, read-only Spacescan.io integration for Chia blockchain lookups, with normal API-key and npm-install risks to consider.

Install this if you want Spacescan.io blockchain lookups and are comfortable sending queried addresses, transaction IDs, NFT/CAT IDs, and searches to Spacescan along with your Spacescan API key. Prefer a dedicated low-scope key, avoid putting secrets in shared or synced shell profiles, and skip npm link if you do not want global scan/spacescan commands.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
This skill sends user-supplied blockchain identifiers and queries to an external Spacescan service without clearly informing the user that their input will be transmitted off-platform. Even though the data is not obviously sensitive in many cases, addresses, transaction IDs, and search terms can still reveal user interests or operational details, creating a privacy and data-handling risk.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"author": "Jeff Coleman",
  "license": "MIT",
  "dependencies": {
    "axios": "^1.6.0"
  },
  "engines": {
    "node": ">=18.0.0"
Confidence
91% confidence
Finding
"axios": "^1.6.0"

Known Vulnerable Dependency: axios==1.6.0 — 10 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +7 more

High
Category
Supply Chain
Confidence
97% confidence
Finding
axios==1.6.0

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
lib/api.js:7