ClawHub
Back to skill

Security audit

Altcoin Season

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent x402 paid-API helper, but it uses a funded wallet private key for automatic paid requests without sufficiently strong user-control guidance.

Install only if you are comfortable letting the skill authorize paid x402 calls. Use a dedicated wallet with very limited USDC, avoid a primary wallet private key, set spending limits where possible, and require explicit confirmation before paid requests.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill instructs the agent to make an x402-authenticated request using an on-chain wallet private key and notes that payment authorization happens automatically, but it does not present this as a prominent safety warning. This can mislead users into invoking the skill without understanding that they are exposing a funded signing key to an external payment flow and may incur real charges per call.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.