ClawHub
Back to skill

Security audit

Crypto Payments

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for creating Shieldz payment links, but its shell examples and optional local MCP package create review-worthy execution risks.

Review before installing. Use the REST flow with a structured HTTP client or safe JSON serialization, keep manage_url and manage_token private, and avoid the optional local npx MCP path unless you trust and sandbox that package. Be comfortable sending wallet address, amount, memo/title, optional email, and manage tokens to Shieldz.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:66
Finding

Shell Command Injection Through User-Controlled Payment Fields

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:107
Finding

Unverified Third-Party Package Download and Execution Through npx

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

md
- an **email address**, only if the user explicitly provides one (see below)
- when reading status, the **manage_token**

Treat every `manage_url` / `manage_token` as a **private access credential**:
anyone holding it can read the account's totals and settings. Do not post them
publicly, paste them into shared contexts, or write them to logs.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 65)May include surrounding context.

Keyless, no Authorization header. Only call this after the confirmation above.

bash
curl https://shieldz.cash/api/v1/links \
  -H "Content-Type: application/json" \
  -d '{
    "settlement": { "chain": "BASE", "asset": "USDC", "address": "0xUserProvidedWallet" },

Static analysis

No suspicious patterns detected.