ClawHub
Back to skill

Security audit

Coinbase

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Coinbase read-only connector helper with sensitive-account access, but the artifact lists only account lookup actions and does not show hidden writes, persistence, or exfiltration.

Install only if you trust OOMOL to mediate Coinbase access and you intend to let the agent read Coinbase account information. Treat any future or connector-discovered write/trading/transfer action as out of scope unless the agent clearly shows the exact payload and asks for explicit approval.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The manifest and description frame the skill as suitable for 'searching and reading data,' but the body instructs agents to enumerate and execute arbitrary live Coinbase connector actions, including potential write or destructive operations. That mismatch can cause an agent or user to trust the skill as read-only when it may actually invoke state-changing capabilities exposed by the connector at runtime.

Intent-Code Divergence

Low
Confidence
88% confidence
Finding
The skill tells agents to inspect the live connector schema and run actions dynamically, while also asserting that untagged actions are reads and safe. Because the actionable surface is determined at runtime rather than fully enumerated in the skill, that safety claim may be incomplete or wrong if new or mislabeled actions exist, enabling unintended writes under a misleading safety model.

Vague Triggers

Medium
Confidence
86% confidence
Finding
The invocation guidance says to use this skill for 'ANY Coinbase request,' which is overly broad and can trigger the skill for requests outside its safest intended scope. In context, that broad routing is more concerning because the skill can dynamically invoke live connector actions, increasing the chance of accidental use for sensitive or state-changing tasks.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.