ClawHub

Tokenmonkey Skill

Security checks across malware telemetry and agentic risk

Overview

This skill appears purpose-aligned for crypto wagering, but it asks for wallet-signing authority and can spend USDC without enough visible guardrails.

Review carefully before installing. Use only a dedicated low-balance wallet, never a primary wallet, and require explicit confirmation plus strict spending limits before any bet, challenge acceptance, or transaction signing.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill explicitly enables wagering, challenge acceptance, claiming winnings, and bankroll management in USDC, but it does not prominently warn that these actions can directly spend funds or result in irreversible financial loss. In an agent context, that omission is dangerous because an operator may authorize the skill without realizing it can autonomously place bets and lose assets on-chain.

Missing User Warnings

High
Confidence
98% confidence
Finding
The skill requires a Solana private key in SOLANA_PRIVATE_KEY and shows direct loading of the secret into code without any warning about credential sensitivity, scope, or safe handling. This is dangerous because compromise, logging, mishandling, or over-broad reuse of that key would allow an attacker or misconfigured agent to take full control of the wallet and any associated funds.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal