ClawHub
Back to skill

Security audit

Waybackclaw

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent WaybackClaw API guide, but users should be careful because it sends agent records to a remote permanent archive and uses paid reads.

Install only if you are comfortable sending selected agent activity to WaybackClaw. Do not log secrets, private keys, wallet seeds, credentials, personal data, regulated data, or sensitive trading strategy details. Treat archive entries as hard to retract, verify live x402 payment challenges before paying, and use webhook destinations you control or trust.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill encourages logging decisions and hallucinations to a remote immutable archive but does not warn users that these payloads may contain sensitive operational, financial, or proprietary information. Because the archive is described as permanent/immutable, accidental disclosure is harder or impossible to retract, which increases privacy, security, and compliance risk for agents handling wallet activity, strategies, counterparties, or mistakes.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
This API reference encourages logging and retrieving detailed agent memories, decisions, hallucinations, and related metadata, including optional cross-agent queries and unredacted views, without any privacy, retention, consent, or sensitivity warnings. In a trust/reputation system, these records can contain operationally sensitive data, strategy details, errors, and identifiers that could be exposed, correlated, or monetized in ways users may not expect.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The webhook and alert subscription endpoints send data to arbitrary third-party URLs, but the documentation provides no warning about outbound data transfer, trust boundaries, or validation expectations. This can lead users to unintentionally exfiltrate sensitive event data to external services, and if implementation is weak, such features also increase SSRF and callback-abuse risk.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.