ClawHub
Back to skill

Security audit

verity-guard

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent and mostly transparent, but it asks users to expose a spend-capable wallet key to unpinned external code and recommends an unpinned privileged plugin.

Install only if you are comfortable sending checked content to VerityLayer and using a dedicated low-balance Base wallet. Pin and review the `verity-guard[x402]` package before exposing `VERITY_WALLET_KEY`, and do not install the optional OpenClaw plugin unless you can pin or verify the exact plugin version and understand its hook permissions.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T08 · Insecure Dependencies

Error
Location
scripts/verity.py:60
Finding

Unpinned Third-Party SDK Receives a Spend-Capable Wallet Private Key

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
references/enforcement.md:64
Finding

Unpinned External Enforcement Plugin Is Recommended for Privileged Tool Interception

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md
**Before anything irreversible** — use `check` (allow / review / block):
- moving money, signing a transaction, approving a spend
- sending something a human will see: email, DM, post, reply
- destructive or state-changing commands: `rm -rf`, `DROP`, `git push --force`, deploy, terminate
- credential / permission / access-control changes, adding forwarding rules or webhooks
- publishing, or making something public

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill explicitly relies on environment access via VERITY_WALLET_KEY but does not declare any tool scope or permission boundary for that capability. This creates an under-specified trust boundary: a host agent may expose sensitive environment data to the skill without clear operator consent or sandboxing expectations, increasing the risk of secret misuse or accidental overexposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The catalog instructs users to directly POST arbitrary inputs such as claims, content, policies, payloads, and evidence to external endpoints, but it does not clearly warn that this data will leave the local system and be transmitted to third-party services. In a security-oriented skill, this omission is especially risky because the very data being checked may contain sensitive prompts, internal context, PII, secrets, or confidential business information.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low
Category
Dangerous Code Execution
Confidence
50% confidence
Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/verity.py (reported line 128)May include surrounding context.

python
elif a.policy:
        _die(1, "--policy applies to `check` only")

    res = getattr(_client(paid=True), method)(a.text, **kwargs)

    # Fail-closed reporting, driven off the SDK's chokepoint rather than a hand-rolled list.
    # Hand-rolling it here missed a whole class: a 200 that parses but carries no decision