ClawHub
Back to skill

Security audit

QELT DEX

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed QELT DEX helper that uses public blockchain RPC calls and user-confirmed signed transactions for expected trading and liquidity tasks.

Before using it, verify all transaction parameters yourself, especially slippage, deadlines, token addresses, and signed transaction payloads. Never provide private keys; only broadcast transactions you intentionally signed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Intent-Code Divergence

Medium
Confidence
93% confidence
Finding
The Safety section at L027 instructs the operator to apply slippage protection with a minimum 1% tolerance on amountOutMin, which implies loosening or tightening slippage should be handled by adjusting the allowed slippage appropriately. The Common Errors table at L148 says to fix slippage failures by 'Increase amountOutMin tolerance,' but increasing amountOutMin makes the trade stricter, not more tolerant, so the documentation contradicts operational behavior and intent.

External Transmission

Medium
Category
Data Exfiltration
Content
1. Verify the contract is still deployed at the documented address:
   ```bash
   curl -fsSL -X POST https://mainnet.qelt.ai \
     -H "Content-Type: application/json" \
     -d '{"jsonrpc":"2.0","method":"eth_getCode","params":["0x11c23891d9f723c4f1c6560f892e4581d87b6d8a","latest"],"id":1}'
   ```
Confidence
60% confidence
Finding
curl -fsSL -X POST https://mainnet.qelt.ai \ -H "Content-Type: application/json" \ -d

External Transmission

Medium
Category
Data Exfiltration
Content
ADDR="USER_ADDRESS_40_HEX_CHARS_NO_0x_PREFIX"

# balanceOf(address) selector: 0x70a08231
curl -fsSL -X POST https://mainnet.qelt.ai \
  -H "Content-Type: application/json" \
  -d "{\"jsonrpc\":\"2.0\",\"method\":\"eth_call\",\"params\":[{\"to\":\"$WQELT\",\"data\":\"0x70a08231000000000000000000000000$ADDR\"},\"latest\"],\"id\":1}"
```
Confidence
60% confidence
Finding
curl -fsSL -X POST https://mainnet.qelt.ai \ -H "Content-Type: application/json" \ -d "{\"jsonrpc\":\"2.0\",\"method\":\"eth_call\",\"params\":[{\"to\":\"$WQELT\",\"data\":\"0x70a08231000000000000

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.