ClawHub
Back to skill

Security audit

Sentio Processor

Security checks for vulnerabilities and agentic risk

Overview

This is a Sentio documentation skill that gives processor development and deployment examples, with no hidden installer or executable payload.

Install if you want Sentio processor guidance. Before using deployment examples, verify the Sentio project, host, account, and rollback/checkpoint settings; before copying analytics examples, consider whether raw wallet addresses should be logged, truncated, hashed, or omitted.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The skill description is overly broad and includes many generic triggers such as project initialization, testing, deployment, blockchain analytics, DeFi protocols, and store entities. This can cause the agent to invoke the skill for loosely related requests, expanding the skill's influence beyond narrowly scoped Sentio tasks and increasing the chance of unsafe or unintended operational guidance.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill provides deployment-affecting commands such as upload, hot-swap, rollback via checkpoint, worker-count changes, and status/log follow-up without clearly warning that these actions can alter production processor state or trigger reindexing/rollback behavior. In an agent setting, omission of explicit impact warnings increases the risk that users or downstream systems execute state-changing commands in production without adequate confirmation or environment checks.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The example code emits wallet addresses (`distinctId`, `from`, `to`) together with transaction activity, which creates linkable user-level behavioral telemetry. In a production analytics skill for blockchain processors, this is privacy-sensitive because users may copy these examples directly and unintentionally store or forward identifiable wallet activity without minimization, consent review, or warning.

Static analysis

No suspicious patterns detected.