ClawHub
Back to skill

Security audit

DeFi Yield Monitor

Security checks across malware telemetry and agentic risk

Overview

This DeFi monitor is mostly purpose-aligned, but it installs and runs mutable code from an external GitHub repository while handling wallet-linked financial data.

Install only if you trust the external GitHub repository and its future main-branch changes. Prefer a version pinned to a reviewed commit or bundled runtime code, add only wallet addresses you intend to monitor, review any generated report before sharing, and enable Telegram/Discord or cron delivery only after confirming exactly what data will be sent.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger list contains broad, high-frequency terms like "APY," "Aave," "check DeFi," and generic Chinese finance terms that can match ordinary conversation and cause unintended activation. In a skill that handles wallet addresses and portfolio reporting, overbroad activation increases the chance of unnecessary data processing or disclosure through automated reports.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill states that it uses public endpoints and supports delivery to Telegram/Discord, but it does not clearly warn that wallet addresses, balances, and position data may be transmitted to third-party services. Users may reasonably assume local-only analysis, so the lack of disclosure creates a privacy and data-handling risk for sensitive financial metadata.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.