ClawHub
Back to skill

Security audit

DAO Treasury Tracker

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent DAO treasury lookup tool that makes disclosed public API calls and does not show hidden persistence, credential access, or destructive behavior.

Before installing, be aware that the tool contacts DeFiLlama over the network for each protocol slug you ask about. Treat the output as a snapshot from an external data source, not financial advice.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill explicitly performs outbound network access to DeFiLlama, but the manifest does not declare any permissions for that capability. Undeclared network access weakens transparency and policy enforcement because users or the platform may not realize the skill can contact external services and transmit user-supplied protocol slugs or receive untrusted remote data.

Static analysis

No suspicious patterns detected.