ClawHub
Back to skill

Security audit

Orderly Api Authentication

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only Orderly Network authentication guide, but it includes unsafe private-key logging and high-impact trading or withdrawal examples that need careful review before copying.

Install only if you need an Orderly authentication reference and will review examples before use. Do not copy any private-key console logging into real code; store keys in a secret manager or protected environment, use least-privilege scopes, test on testnet first, and require explicit user confirmation before withdrawals, transfers, or live trading.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The examples generate an Ed25519 private key and then print it to the console in hex form. In real deployments, console logs are often collected by browsers, terminals, CI systems, cloud logging agents, or support tooling, so this can directly leak API signing secrets and enable full authenticated API access including trading and asset actions within the key scope.

VirusTotal

55/55 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.