ClawHub
Back to skill

Security audit

Subgraph Registry

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed subgraph-discovery MCP server, but users should control paid x402 follow-up queries and optional network/server modes.

Install only if you expect a first-run registry download and possible model download for semantic search. Keep HTTP/SSE mode disabled unless you intentionally want a local server, pin the package version, and require explicit approval and spending limits before any agent uses a funded wallet or Studio API key to follow returned query URLs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)

Tp4

High
Category
MCP Tool Poisoning
Confidence
82% confidence
Finding
The declared skill purpose emphasizes subgraph discovery, but the documented behavior also includes automatic remote downloads, optional Hugging Face model fetching, and an HTTP/SSE server mode with health/OpenAPI endpoints. This mismatch can cause operators to deploy the skill in environments that assume offline, stdio-only, low-exposure behavior, when in fact it can open listeners and fetch unpinned remote content under some modes, increasing attack surface and policy-bypass risk.

Context-Inappropriate Capability

Medium
Confidence
86% confidence
Finding
The skill performs a runtime network download of its SQLite database and writes it to disk, which expands trust from the packaged artifact to a live remote source. Although the SHA-256 pin materially reduces tampering risk, this still creates an unexpected network and file-write side effect for a discovery skill, and the `SUBGRAPH_REGISTRY_SKIP_VERIFY=1` bypass could allow unsafe content if enabled in production.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The README explicitly describes a client flow where an initial 402 response triggers an automatic retry that signs an EIP-3009 USDC transfer. In an agent context, this can cause real spending without a clear opt-in, spending cap, or user confirmation step, which is risky because agents may execute examples or adopt the documented pattern directly.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The OpenAPI descriptions explicitly advertise `query_url_x402` endpoints that require paying $0.01 USDC per query and legacy query URLs that require a Studio API key, but they do not clearly warn that an agent may trigger real spending or handle credentials. In an agent/tooling context, this can lead to unintended micropayments, silent credential use, or unsafe automated follow-on actions if downstream systems treat the returned URLs as safe to invoke automatically.

Missing User Warnings

Low
Confidence
89% confidence
Finding
The endpoint descriptions explicitly advertise returned x402 paid query URLs and legacy API-key-based access, but they do not clearly warn downstream agents or users that following those URLs can incur charges or require handling sensitive credentials. In an agent setting, descriptive text often drives autonomous tool chaining, so omission of a cost/credential warning can lead to unintended paid requests or unsafe propagation of API-key workflows.

Missing User Warnings

Low
Confidence
92% confidence
Finding
The recommendation endpoint states that it returns preferred x402 query URLs, but it does not prominently warn that using those URLs may trigger billable requests. Because this endpoint is goal-driven and likely to be used by autonomous agents, the absence of a cost warning increases the risk of unreviewed follow-up actions that spend funds.

Missing User Warnings

Low
Confidence
93% confidence
Finding
The detail endpoint goes further by returning step-by-step instructions for both paid and API-key query paths, yet it lacks a strong warning about billing and credential sensitivity. In practice, this makes it easier for an agent or user to operationalize a paid or credentialed flow without appreciating that it may spend money or expose a Studio API key in logs, prompts, or downstream tools.

Missing User Warnings

Low
Confidence
77% confidence
Finding
The code downloads remote content and writes `registry.db` locally without an explicit user-facing warning or confirmation. Even with hash verification, silent creation/overwrite of local files from network content can surprise operators and increase the risk of unintended state changes in automated environments.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The returned tool guidance recommends a paid x402 flow and mentions clients that can sign and retry automatically, but it does not clearly warn that using the URL may trigger wallet signing and on-chain/token charges. In an agent context, that omission is dangerous because downstream agents may treat the instructions as safe to automate without human approval.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The detailed query instructions normalize an automatic payment-signing workflow ('sign and retry') without cautionary language or an approval boundary. In agent ecosystems, such wording can encourage unattended spending behavior, especially when tools are chained from discovery to execution.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
Tool descriptions repeatedly recommend the paid x402 path but do not prominently disclose that using those endpoints may incur charges and trigger wallet-signing actions. Because MCP tool descriptions shape agent planning, this can cause agents to prefer a paid path without surfacing the financial/security implication to the user.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"author": "PaulieB14",
  "license": "MIT",
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.29.0",
    "@xenova/transformers": "^2.17.2",
    "better-sqlite3": "^11.8.2",
    "express": "^4.21.0"
Confidence
91% confidence
Finding
"@modelcontextprotocol/sdk": "^1.29.0"

Unpinned Dependencies

Low
Category
Supply Chain
Content
"license": "MIT",
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.29.0",
    "@xenova/transformers": "^2.17.2",
    "better-sqlite3": "^11.8.2",
    "express": "^4.21.0"
  }
Confidence
91% confidence
Finding
"@xenova/transformers": "^2.17.2"

Unpinned Dependencies

Low
Category
Supply Chain
Content
"dependencies": {
    "@modelcontextprotocol/sdk": "^1.29.0",
    "@xenova/transformers": "^2.17.2",
    "better-sqlite3": "^11.8.2",
    "express": "^4.21.0"
  }
}
Confidence
91% confidence
Finding
"better-sqlite3": "^11.8.2"

Unpinned Dependencies

Low
Category
Supply Chain
Content
"@modelcontextprotocol/sdk": "^1.29.0",
    "@xenova/transformers": "^2.17.2",
    "better-sqlite3": "^11.8.2",
    "express": "^4.21.0"
  }
}
Confidence
91% confidence
Finding
"express": "^4.21.0"

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.