ClawHub
Back to skill

Security audit

Clanker

Security checks across malware telemetry and agentic risk

Overview

The skill appears aimed at legitimate token deployment, but it can use a wallet private key to spend real ETH with under-scoped safeguards.

Install only if you understand that this can sign irreversible blockchain transactions and spend real ETH. Use a fresh low-balance wallet, prefer testnet first, protect any config file tightly, and manually review the network, signer address, ETH amount, contract action, and transaction data before broadcasting on mainnet.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill documentation indicates use of environment/config secrets, file reads, and shell commands, but the manifest does not declare corresponding permissions or capabilities. This weakens user visibility and policy enforcement around what the skill can access, especially because it handles private keys and invokes local tooling.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The skill advertises ERC20 deployment support in the manifest and setup/usage sections, but later states that deployment is only a placeholder and not actually implemented. This mismatch can mislead users into trusting deployment commands for real blockchain actions, increasing the chance of failed transactions, unsafe workarounds, or accidental exposure of private keys while troubleshooting.

Intent-Code Divergence

High
Confidence
96% confidence
Finding
The usage section presents deploy and testnet-deploy commands as functional, but the test results explicitly say deployment is a placeholder. Presenting non-functional blockchain deployment commands as working is dangerous because users may attempt real-wallet operations under false assumptions and could send funds or reveal sensitive configuration during failure handling.

Intent-Code Divergence

Medium
Confidence
88% confidence
Finding
The CLI advertises initial_lp_eth as 'Initial liquidity in ETH', but the implementation uses any positive value to invoke a dev-buy extension and attach ETH to that extension call. In a blockchain deployment tool that signs and sends real-value transactions, misleading value semantics can cause users to unintentionally spend funds or create token launch behavior they did not intend.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The mainnet deployment instructions describe creating a token with initial ETH liquidity but do not clearly warn that this spends real ETH, creates irreversible on-chain transactions, and may incur gas and liquidity loss. In a wallet-related skill, omission of this warning materially increases the risk of unintended financial loss.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The script reads a long-lived private key from persistent local config and passes it as a command-line argument to `deploy.py`. Command-line arguments can be exposed to process listings, shell history/debugging, crash reports, or other local monitoring, increasing the chance of wallet compromise and theft of on-chain funds.

Missing User Warnings

High
Confidence
97% confidence
Finding
The deployment path triggers an irreversible on-chain token deployment using a configured private key without an explicit confirmation prompt, dry-run, or strong transaction summary. In this skill context, that is especially dangerous because the stated purpose is live blockchain deployment, so a mistaken invocation can immediately spend funds or deploy unwanted contracts.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
Accepting a private key as a command-line argument exposes it to shell history, process listings, audit logs, and other local telemetry on the host. In this skill's context, the private key directly authorizes on-chain transactions and asset control, so leakage can lead to irreversible loss of funds and full compromise of the deployer account.

Missing User Warnings

Medium
Confidence
72% confidence
Finding
The script creates a persistent config file in the user's home directory containing a private_key field, normalizing storage of sensitive credentials in plaintext without any warning about secure handling. In the context of a blockchain deployment skill that explicitly requires a private key, this can encourage unsafe secret management and increase the chance that users later paste real keys into an insecure file.

Session Persistence

Medium
Category
Rogue Agent
Content
---
name: clanker
description: Deploy ERC20 tokens on Base using Clanker SDK. Create tokens with built-in Uniswap V4 liquidity pools. Supports Base mainnet and Sepolia testnet. Requires PRIVATE_KEY in config.
metadata: {"clawdbot":{"emoji":"🪙","homepage":"https://clanker.world","requires":{"bins":["curl","jq","python3"]}}}
---
Confidence
86% confidence
Finding
Create tokens with built-in Uniswap V4 liquidity pools. Supports Base mainnet and Sepolia testnet. Requires PRIVATE_KEY in config. metadata: {"clawdbot":{"emoji":"🪙","homepage":"https://clanker.world"

Session Persistence

Medium
Category
Rogue Agent
Content
$0 info 0xabcd... --network testnet

Setup:
    Create ~/.clawdbot/skills/clanker/config.json with RPC and private keys.
    See SKILL.md for configuration details.

EOF
Confidence
87% confidence
Finding
Create ~/.clawdbot

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.