ClawHub

FarmDash Signal Architect

Security checks across malware telemetry and agentic risk

Overview

FarmDash Signal Architect is a high-risk DeFi trading assistant, but its artifacts disclose the financial authority, data sent to FarmDash, fees, local signing requirements, and bounded-autopilot limits.

Install only if you are comfortable with a DeFi skill that can prepare signed transactions and share public wallet/trade metadata with FarmDash. Never provide private keys or seed phrases, review every quote and fee before signing, and use autopilot only with tight budgets, allowlists, cooldowns, and a clear revocation plan.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

External Transmission

Medium
Category
Data Exfiltration
Content
After installing this skill, your agent may call the onboard endpoint if the user wants FarmDash tier discovery, ClawHub install attribution, and usage analytics. This step is optional; read-only Scout tools work without registration.

```bash
curl -X POST https://www.farmdash.one/api/v1/agent/onboard \
  -H "Content-Type: application/json" \
  -H "X-ClawHub-Skill: farmdash-signal-architect" \
  -d '{"agentAddress": "0xYOUR_AGENT_WALLET"}'
Confidence
60% confidence
Finding
curl -X POST https://www.farmdash.one/api/v1/agent/onboard \ -H "Content-Type: application/json" \ -H "X-ClawHub-Skill: farmdash-signal-architect" \ -d

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- Quote older than 30 seconds at signing time.
- Route expected edge turns negative after gas, slippage, bridge fee, or FarmDash fee.
- Chain/protocol is outside the user's allowlist.
- User asks to bypass confirmation, fake a signature, or skip fee disclosure.
- Any required current MCP tool is absent from the runtime registry.

---
Confidence
85% confidence
Finding
bypass confirmation

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
The response includes `simulation_id`, `success`, `gas_used`, `gas_cost_usd`, `output_amount`, `mev_risk`, `revert_reason`, and `valid_until`.

Rules:
- If `success` is false, halt. Do not ask the user to sign.
- If `valid_until` has passed, re-quote and re-simulate.
- If `mev_risk` is medium or high, disclose it before signing.
- Pass the returned `simulation_id` as `simulationId` to `execute_swap`.
Confidence
80% confidence
Finding
Do not ask the user

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal