ClawHub
Back to skill

Security audit

AI Compute

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed paid AI gateway wrapper, but it gives an agent broad paid API access including prepaid credit operations without strong user-confirmation or spending controls.

Review before installing. This skill can send your prompts and media URLs to a third-party gateway and can trigger real USDC micropayments, including prepaid credit deposit, execute, and refund flows. Use it only with explicit approval for each paid call, a limited key or wallet, and a clear spending cap.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description presents a comprehensive AI compute agent with many advanced model and blockchain-related capabilities. The supplied code does not implement any of those functions directly. It only wraps curl calls to a remote gateway, supports optional API-key authentication, formats GET query strings, and reports x402-style payment-required responses. While x402 payment flow is mentioned in the description, that is only one small aspect; the primary behavior shown here is a research/API gateway caller, not a 27-tool AI compute agent. This is therefore a material description-versus-behavior mismatch.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · scripts/compute.sh (reported line 2)May include surrounding context.

sh
#!/usr/bin/env bash
# deep-research gateway caller — handles x402 payment flow via curl
# Usage:
#   research.sh GET  /api/v1/research/papers/search '{"query":"restaking"}'
#   research.sh POST /api/v1/search/web '{"query":"ethereum restaking 2026"}'

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The README explicitly advertises that tool calls trigger real x402 micropayments and includes prepaid credit operations, but it does not provide any user-facing warning about irreversible charges, wallet usage, spending limits, or consent expectations. In an agent/skill ecosystem, users may invoke tools indirectly through an LLM-driven workflow, so unclear disclosure increases the risk of unexpected financial loss from accidental or repeated tool execution.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill advertises shell-based invocation and outbound gateway access but does not declare any explicit tool scope such as allowed-tools or permissions. That creates an under-specified trust boundary: an agent may invoke shell/network capabilities more broadly than a reviewer expects, increasing the chance of unintended external requests or command execution paths.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill encourages sending prompts, text, audio URLs, and other potentially sensitive content to external AI and compute providers, but it does not clearly warn users that their data leaves the local environment. In an agent context, this omission can lead to accidental disclosure of proprietary, personal, or regulated data to third parties.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The compute-futures endpoints include deposit, execute, and refund operations tied to real micropayments and prepaid balances, yet the skill lacks a strong warning that these actions can trigger real financial charges and balance changes. In an autonomous or semi-autonomous agent flow, that omission materially raises the risk of unintended spending or irreversible account actions.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The implementation exposes research and web-search gateway access rather than the declared AI compute capabilities. In an agent ecosystem, this is a security-relevant mismatch because consumers may grant trust, credentials, or data access under the assumption of local/compute-oriented operations while the skill actually performs outbound network requests to a third-party gateway.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The script is mislabeled and uses research-specific naming, endpoints, and payment-flow messaging despite being shipped as a compute skill helper. This kind of capability/identity mismatch is dangerous because it can mislead operators about what external services are being contacted, what data is being sent, and what billing/authentication paths are involved, increasing the chance of unintended data disclosure or unauthorized paid requests.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.