ClawHub
Back to skill

Security audit

Radix Explorer

Security checks across malware telemetry and agentic risk

Overview

This is a read-only Radix blockchain lookup skill that uses a disclosed npm CLI and remote data endpoint, with the main caveat that wallet lookup inputs are sent to external services.

Install only if you are comfortable adding the mcporter npm CLI and sending Radix wallet addresses, token addresses, .xrd domains, and related lookup queries to the Emily remote MCP service and its data providers. Avoid querying wallets or portfolios you consider sensitive unless that external-service exposure is acceptable.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill instructs the agent to query wallet balances, transaction history, and LP positions using external services, which necessarily exposes user-supplied wallet addresses and associated activity to third-party APIs. While blockchain addresses are public on-chain, users may not expect the assistant to transmit them to services such as Emily, Radix Gateway, CoinMarketCap, or Attos Earn, creating a privacy and metadata-leak risk through service-side logging, correlation, and retention.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.