ClawHub
Back to skill

Security audit

Gas Fee Tracker

Security checks across malware telemetry and agentic risk

Overview

This skill does what it claims: it checks public blockchain gas prices and optionally writes a user-requested local history log.

Install this if you are comfortable with it contacting publicnode.com RPC services when run. Use --log only with a path where you want gas snapshots appended, and remember that it reports current legacy gas price data rather than signing or submitting transactions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill advertises and instructs use of functionality that performs outbound network access to public RPC endpoints and writes logs to local files, yet it declares no permissions. This creates a transparency and governance gap: users or hosting platforms may execute the skill without realizing it can contact external services and persist data, undermining least-privilege controls and policy enforcement.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.