ClawHub
Back to skill

Security audit

airdrop-eligibility-tracker

Security checks for vulnerabilities and agentic risk

Overview

This skill is a read-only wallet activity checker that clearly discloses its public RPC network queries and does not request private keys or mutate data.

Before installing, understand that public wallet addresses you check will be sent to publicnode.com RPC endpoints. Do not provide private keys or seed phrases; this skill does not need them.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Static analysis

No suspicious patterns detected.