ClawHub

SUPAH Whale Tracker

Security checks across malware telemetry and agentic risk

Overview

The skill appears to do the advertised Base whale-tracking work, but it can cause automatic USDC micropayments with unclear trigger and pricing boundaries.

Install only if you are comfortable with automatic x402 USDC payments for API calls. Use a wallet with a strict spend cap, require confirmation before paid or alert-style actions, verify the SUPAH_API_BASE endpoint, and confirm the actual pricing with the publisher before ongoing use.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
86% confidence
Finding
The invocation examples are broad enough that an agent could trigger this paid, networked skill on loosely related user requests, increasing the chance of unintended external calls and billable actions. Because the skill supports automatic x402 payments and outbound API access, vague trigger boundaries make accidental invocation more risky than in a purely local, free skill.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill states that the agent's x402-compatible HTTP client pays automatically, but the warning about charges is not prominent at the point of use. This creates a real risk of silent or unexpected micropayments, especially when combined with broad natural-language invocation examples that may cause users to incur costs without clear informed consent.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal