ClawHub
Back to skill

Security audit

search CA & Token

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward OKX market-data helper that uses OKX API credentials only to sign requests to OKX endpoints.

Install only if you intend to query OKX Web3 market data. Use a least-privilege OKX API key suitable for read-only market access, provide secrets through environment variables or a secure secret store, and avoid pasting or logging real credentials in chat or examples.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
80% confidence
Finding
The trigger list includes broad phrases like market data, token price, and holder, which overlap with many ordinary crypto queries. Overbroad triggers can cause accidental invocation of a networked skill, leading to unnecessary external calls or unintended use of credentials in contexts where the user did not specifically request OKX.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The document instructs use of API Key, Secret, and Passphrase and shows signed requests to an external endpoint, but it does not warn users about credential sensitivity or outbound transmission. In an agent setting, this increases the risk of unsafe secret handling, accidental logging, or exposing privileged API credentials to third-party services.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal