ClawHub
Back to skill

Security audit

NFT Floor Sweep Calculator

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed NFT price-estimation helper that queries public marketplace APIs and does not trade, access wallets, or persist data.

Install only if you are comfortable with collection slugs or NFT IDs being sent to Magic Eden or CoinGecko for live pricing. Treat results as rough planning estimates, not executable trade quotes or financial advice.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

External Transmission

Medium
Category
Data Exfiltration
Content
To find a CoinGecko NFT id, the collection's slug is usually the lowercased
name with no spaces (verify with `GET
https://api.coingecko.com/api/v3/nfts/list`). Magic Eden slugs are the
collection's symbol shown in its Magic Eden URL.

## What it does
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
def coingecko_floor(nft_id):
    data = http_get(f"https://api.coingecko.com/api/v3/nfts/{nft_id}")
    fp = data.get("floor_price", {})
    native = fp.get("native_currency")
    symbol = data.get("native_currency_symbol", "ETH")
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.