ClawHub
Back to skill

Security audit

AB5D Bounties

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent bounty-work helper with disclosed network, wallet-signature, and short-lived claim-token handling, but users should treat the claim token as sensitive.

Install only if you intend to let the agent interact with AB5D bounty endpoints and coordinate wallet-signed claims. Do not provide private keys or recovery phrases, confirm each claim with the operator, and treat any claim token as a temporary bearer credential that should not be printed, logged, or included in submitted artifacts.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill instructs the agent to retain a claim token that authorizes release and submission actions for 48 hours, but it does not explicitly classify the token as a sensitive secret or define safe handling requirements. In an agent setting, such bearer tokens are high-risk because they may be logged, echoed in chat, stored in artifacts, or exposed to other tools, enabling unauthorized submission, release, or hijacking of the bounty workflow.

Static analysis

No suspicious patterns detected.