ClawHub
Back to skill

Security audit

Btc Contract Scanner

Security checks across malware telemetry and agentic risk

Overview

This is a small trading-signal skill whose Telegram alert feature is disclosed and aligned with its purpose, though users should treat any shared trading information as sensitive.

Before installing, understand that Telegram alerts may expose signal or strategy information to Telegram, a bot, or chat participants. Avoid sending API keys, account balances, open positions, or personal identifiers unless the publisher documents exactly how that data is handled.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
86% confidence
Finding
The skill explicitly promotes Telegram real-time push notifications but does not disclose what data is sent to Telegram, who can access it, or the privacy implications of using a third-party messaging platform. Because this is a trading signal skill involving potentially sensitive behavioral, account, or strategy information, users may unknowingly expose data to external services, bots, or chat participants.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.