ClawHub
Back to skill

Security audit

circle chain skill

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Circle Chain SDK/CLI guide with disclosed wallet, network, GeoIP, and local config behavior.

Install only if you trust the @lidh04/circle-chain-sdk npm package and are comfortable using a global circle CLI for wallet and transfer workflows. Set an explicit host or CIRCLE_SKIP_GEO=1 if a third-party GeoIP request is not acceptable in your environment, and treat account credentials and pay passwords as sensitive.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill documents that the SDK performs an automatic GeoIP lookup against a third-party service (`https://ipwho.is/`) to infer country and select a gateway, but it does not warn that this leaks the user's IP-derived location and usage metadata off-host. In a developer skill, this omission is security-relevant because users may invoke the SDK/CLI in environments where outbound privacy-sensitive network calls are unexpected or prohibited.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal