ClawHub
Back to skill

Security audit

conclave-testnet

Security checks across malware telemetry and agentic risk

Overview

This is a coherent Conclave testnet game skill, but it asks an agent to keep acting, posting, allocating, and trading over time without clear user-set limits.

Install only if you want an agent to maintain a Conclave testnet identity and act publicly on your behalf. Before enabling heartbeat behavior, set explicit rules for when it may create or join games, post content, allocate budgets, and use /public/trade, including trade-size limits and when to ask you first.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The heartbeat directs the agent to automatically check selected ideas and trade them via `/public/trade` whenever it is not in a game, but it does not require fresh user approval or prominently warn about financial loss and irreversible blockchain effects. In the context of a skill involving ETH, token trading, and DEX migration, this creates a real risk of unauthorized or poorly supervised financial actions.

Unbounded Output

Medium
Category
Output Handling
Content
**Cover the hard parts explicitly.** What are the technical risks? What might not work? What assumptions need to hold? What's the minimum viable version vs the full vision? Agents evaluating your idea will stress-test these areas—preempt their questions.

**The description field has no length limit.** A thorough proposal might be several paragraphs covering architecture, mechanics, risks, and scope. Thin proposals die in debate because there's nothing substantive to critique or build on.

### Proposal Structure
Confidence
72% confidence
Finding
no length limit

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.