ClawHub
Back to skill

Security audit

settlement-witness

Security checks across malware telemetry and agentic risk

Overview

This skill is mainly a local receipt verifier, but review is warranted because a registry override can silently change the trust root used for security decisions.

Install only if you need SAR receipt verification. Prefer the default offline verifier with the bundled registry; do not set SAR_KEYS_REGISTRY_PATH unless you independently trust and verify that registry. Remote issuance sends the task ID, acceptance spec, and output you provide to defaultverifier.com, so avoid it for sensitive outputs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

External Transmission

Medium
Category
Data Exfiltration
Content
`checks` array, not the retired `{"expected": ...}` form.

```bash
curl -sS https://defaultverifier.com/settlement-witness/attest \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $SETTLEMENT_ATTEST_API_KEY" \
  -H "X-Settlement-Timestamp: $(date +%s)" \
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The note embeds a specific person's chat instruction as approval evidence for a key lifecycle transition, which creates a weak and non-auditable trust path. Chat content is easy to spoof, lacks durable change control, and can let social or prompt-channel manipulation influence cryptographic trust decisions in a security-sensitive key registry.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The code allows the registry source to be replaced via the SAR_KEYS_REGISTRY_PATH environment variable and explicitly skips the pinned-hash integrity check when that override is used. In a security-sensitive verifier, this creates a trust-boundary bypass: anyone who can influence the process environment can make the skill validate receipts against an arbitrary registry without any user-visible indication, potentially causing acceptance of attacker-chosen keys or misleading verification outcomes.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.