ClawHub
Back to skill

Security audit

Conflux Wallet Skill

Security checks across malware telemetry and agentic risk

Overview

This wallet skill is transparent about controlling crypto funds, but it installs unpinned external code that would handle private keys and irreversible transactions.

Install only if you are comfortable reviewing or pinning the GitHub code before use. Use a new low-balance wallet, back up and protect ~/.cfx-wallet.json, and manually verify chain, recipient, token, amount, approvals, and gas before confirming any transaction.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The README advertises generic contract interaction as a normal command without clearly warning that such calls may be state-changing transactions that can transfer funds, approve spenders, or alter on-chain state. In an agentic context, this is especially risky because users or upstream agents may treat the interface as a harmless read-only utility and unknowingly authorize dangerous actions.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.