ClawHub
Back to skill

Security audit

shopify-batch-payouts

Security checks across malware telemetry and agentic risk

Overview

This skill describes a disclosed USDC batch-payout workflow with strong validation and confirmation safeguards, though users should recognize that crypto payouts are irreversible.

Install only if you intend to use Spraay-style USDC batch payouts. Before any execution, verify every wallet address and amount, confirm the total and fees, and remember that on-chain payouts cannot be reversed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The skill description is broadly scoped to trigger on almost any multi-recipient payment request, even outside a clear Shopify or Spraay-specific context. This can cause the agent to select a high-risk crypto payout workflow too eagerly, increasing the chance of misrouting users into irreversible on-chain payment actions when a different tool or a narrower confirmation flow would be more appropriate.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.