ClawHub
Back to skill

Security audit

Cross Asset Contagion

Security checks across malware telemetry and agentic risk

Overview

This skill is coherent but asks an agent to use an EVM private key to automatically pay for a $25 on-chain request, which needs careful review before installation.

Install only if you are comfortable letting the agent use an EVM private key for paid x402 requests. Use a dedicated low-balance wallet on Base with only the USDC you intend to spend, avoid reusing a valuable wallet key, and require explicit approval or a spending cap before calls.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill explicitly requires an EVM private key and states that the client will automatically handle payment authorization, but it does not present a prominent warning about the financial and wallet-security implications. This is dangerous because users or agents may invoke the skill without realizing it can spend funds on their behalf and requires highly sensitive key material in the environment.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal