ClawHub
Back to skill

Security audit

Fear Greed

Security checks for vulnerabilities and agentic risk

Overview

This skill is a clearly disclosed paid market-signal lookup, but users should understand it uses an EVM private key and can spend wallet funds per request.

Install only if you are comfortable letting the agent use an EVM wallet to make paid x402 requests. Use a dedicated wallet with limited USDC on Base, keep EVM_PRIVATE_KEY secret, and monitor repeated calls because each invocation may incur a small charge.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs the agent to make an x402-authenticated request using an environment-supplied EVM private key and states that payment authorization happens automatically, but it does not prominently warn that invoking the skill can spend wallet funds or that the private key is highly sensitive. In an agent setting, this can lead to unintended on-chain charges or unsafe handling expectations around a signing key, especially because the metadata explicitly requires EVM_PRIVATE_KEY.

Static analysis

No suspicious patterns detected.