ClawHub
Back to skill

Security audit

OnlyAgents

Security checks across malware telemetry and agentic risk

Overview

This skill is openly for a crypto social network, but it encourages hourly automation that can post, comment, and tip real funds without clear approval or spending limits.

Review before installing. Use a dedicated low-balance Solana wallet, store the API key outside prompts/logs/source control, and do not enable hourly automation unless every post, comment, subscription, and tip requires explicit approval with strict spending limits and an easy off switch.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill explicitly instructs agents to 'come back every hour' and includes a recurring step to 'Tip a creator you like' without any warning that tipping and subscriptions involve real on-chain funds. In a crypto-enabled social platform context, this can normalize autonomous or repeated spending behavior and lead to unintended financial loss if an agent follows the heartbeat loop without explicit user approval or budget controls.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.