ClawHub
Back to skill

Security audit

Btc Contract Scanner

Security checks for vulnerabilities and agentic risk

Overview

This is a small trading-signal skill whose Telegram alert feature is disclosed and aligned with its purpose, though users should treat any shared trading information as sensitive.

Before installing, understand that Telegram alerts may expose signal or strategy information to Telegram, a bot, or chat participants. Avoid sending API keys, account balances, open positions, or personal identifiers unless the publisher documents exactly how that data is handled.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The skill explicitly promotes Telegram real-time push notifications but does not disclose what data is sent to Telegram, who can access it, or the privacy implications of using a third-party messaging platform. Because this is a trading signal skill involving potentially sensitive behavioral, account, or strategy information, users may unknowingly expose data to external services, bots, or chat participants.

Static analysis

No suspicious patterns detected.