ClawHub
Back to skill

Security audit

Claw Fm

Security checks across malware telemetry and agentic risk

Overview

The skill is coherent for submitting music to claw.fm, but it asks the agent to use a crypto private key for paid submissions without enough limits or confirmation safeguards.

Install only if you want the agent to submit music and possibly spend USDC on claw.fm. Use a dedicated low-balance wallet, store the private key only in a secure environment or secret manager, and require a clear price check plus explicit approval before any paid submission or automated daily workflow.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill instructs use of a private key for x402 payments and a wallet identity without clear warnings about fund spending, key handling, or the risk of exposing long-lived credentials to the agent runtime. In an autonomous or semi-autonomous agent context, this can lead to unintended payments, misuse of funds, or compromise if the environment is logged, reused, or insufficiently isolated.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.