ClawHub
Back to skill

Security audit

Fg Micro

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent paid market-signal lookup, but users should protect the wallet key and limit funds because calls can spend USDC automatically.

Install only if you want the agent to make paid x402 requests to APEX Runner. Use a dedicated low-balance Base wallet, never expose or log EVM_PRIVATE_KEY, and remember that high-frequency polling can create repeated USDC charges.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill instructs the agent to use an environment-stored EVM private key to authenticate paid requests, but it provides no warning about the sensitivity of that credential, the financial authority it confers, or safe handling expectations. In this context, the key can authorize on-chain payment flows, so normalizing direct use of a wallet private key in a third-party request pattern increases the risk of accidental exposure, misuse, or unsafe agent integrations.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal