ClawHub
Back to skill

Security audit

Receipts Guard

Security checks across malware telemetry and agentic risk

Overview

This skill has powerful wallet, identity, local storage, and HTTP server features, but they are documented and fit its receipt and arbitration purpose.

Install only if you need receipt capture, agent identity, payment/arbitration, or server workflows. Use a dedicated low-balance wallet, protect ~/.openclaw/receipts, configure RECEIPTS_API_KEY and strict CORS before server deployment, test DID-signed authentication before relying on it, and treat recovery-controller verification as requiring manual review.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)

Lp3

Medium
Category
MCP Least Privilege
Confidence
97% confidence
Finding
The skill advertises substantial capabilities involving environment variables, network access, and shell execution, but does not declare corresponding permissions. This weakens the trust boundary for operators and automated policy systems, because the skill can access secrets, make external requests, and invoke commands without those capabilities being transparently surfaced in metadata.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The declared description materially understates the actual behavior: beyond ERC-8004/x402/arbitration, the skill performs local identity management, document capture, storage, export, witnessing, HTTP serving, and interaction with external services. This mismatch can cause users or orchestration frameworks to grant trust on the assumption of a narrower scope, increasing the chance of unintended data exposure, secret handling, or network activity in sensitive environments.

Context-Inappropriate Capability

Medium
Confidence
79% confidence
Finding
Exposing an HTTP server materially expands the attack surface from a local CLI into a network-reachable service. Although the server includes some hardening, this capability is not clearly declared in the skill description, increasing the chance that it is deployed or enabled without appropriate review, authentication setup, or network isolation.

Context-Inappropriate Capability

High
Confidence
95% confidence
Finding
The code performs live on-chain registration using a wallet private key from the environment, which is a highly sensitive capability. If this skill is run in an automated agent environment, compromised inputs, misconfiguration, or unauthorized invocation could trigger blockchain transactions and consume funds or register unintended data.

Intent-Code Divergence

Medium
Confidence
92% confidence
Finding
The implementation records a user-supplied verification URL and marks the controller as verified without actually validating ownership or post contents. An attacker or mistaken operator could bind an unverified recovery controller, undermining the trust model for identity recovery and potentially enabling fraudulent recovery claims.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The documentation demonstrates commands and a server mode that persist agreements, evidence, DID material, and related metadata to local storage and may expose records through API endpoints, but it does not prominently warn about the sensitivity of that data. In this skill's context, the stored content can include contractual terms, dispute evidence, controller information, and key material paths, so omission of a warning increases the risk of accidental retention, insecure hosting, or unintended disclosure.

Missing User Warnings

Medium
Confidence
82% confidence
Finding
The skill persistently writes captured documents and screenshots to disk under the user's home directory without a clear warning or consent flow about local storage of potentially sensitive legal text, screenshots, or evidence. In shared hosts, agent sandboxes, or developer workstations, this can cause unintended retention and exposure of confidential information.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
Accessing a wallet private key to sign on-chain transactions is a sensitive operation, yet there is no clear user-facing disclosure or confirmation immediately before use. In agentic or automated deployments, this increases the chance of silent fund usage or unintended transaction execution.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
});

  // Status becomes pending_confirmation (other party must confirm)
  // For simplicity, we'll auto-confirm after a grace period (in production, this would be interactive)
  agreement.status = 'pending_confirmation';
  agreement.fulfillmentClaimed = {
    by: agentId,
Confidence
88% confidence
Finding
auto-confirm

Unpinned Dependencies

Low
Category
Supply Chain
Content
"author": "Remaster.io",
  "license": "MIT",
  "dependencies": {
    "ethers": "^6.11.0",
    "tweetnacl": "^1.0.3"
  },
  "engines": {
Confidence
93% confidence
Finding
"ethers": "^6.11.0"

Unpinned Dependencies

Low
Category
Supply Chain
Content
"license": "MIT",
  "dependencies": {
    "ethers": "^6.11.0",
    "tweetnacl": "^1.0.3"
  },
  "engines": {
    "node": ">=18.0.0"
Confidence
93% confidence
Finding
"tweetnacl": "^1.0.3"

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.