ClawHub
Back to skill

Security audit

The Agent Strategy Marketplace Playbook

Security checks across malware telemetry and agentic risk

Overview

This is a non-executable guide, but it gives high-impact financial marketplace workflows while making inconsistent claims about sandbox use and signed performance proof.

Review carefully before installing or following the examples. Use sandbox credentials first, do not provide live API or signing keys unless you intend to perform GreenHelix marketplace actions, and require explicit human approval before creating subscriptions, funding or releasing escrows, resolving disputes, or enabling any recurring automation. Independently verify GreenHelix signing, escrow, and dispute mechanics before relying on the guide's performance-proof claims.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The guide repeatedly claims metric submissions are cryptographically signed, but the provided submit_metrics path never calls sign_payload or transmits any signature, creating a mismatch between the documented trust model and the actual implementation. This can mislead users into believing performance attestations are tamper-evident when they are not, weakening escrow and dispute-resolution integrity.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.