clawmegle staking

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:45 AM UTC
• Version: 1.0.0

Overview

This appears to be a real CLAWMEGLE staking helper, but it can submit live blockchain transactions and uses weakly scoped credential and confirmation practices.

Review before installing. Use a dedicated low-balance wallet, verify the Base chain, token address, contract address, and calldata independently, protect or rotate the Bankr API key, avoid raw private keys when possible, and do not enable heartbeat automation or reward deposits unless you have explicit approval rules for every transaction.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The skill metadata says it is for staking and managing a staking position, but the document also exposes an administrative-style reward deposit flow that moves ETH and CLAWMEGLE into the contract for distribution. This hidden expansion of capability matters because agents may invoke a fund-moving operation outside the user-expected scope, increasing the chance of unauthorized or mistaken transfers.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The documentation includes an admin/funder capability to deposit rewards, but the manifest frames the skill as a normal staking-user tool. That scope mismatch can cause policy engines or users to trust the skill for low-risk portfolio actions while it also supports transferring treasury-like funds on-chain.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The manifest says the skill supports Bankr and direct wallet transactions, but the documented direct-wallet workflow materially expands sensitivity by using a local private key. This creates a higher-risk execution path than the manifest communicates, especially because it instructs loading key material into the environment for signing on-chain transactions.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill instructs reading raw private-key material from disk and exporting it into an environment variable. Exposing secret keys this way increases the risk of credential theft through shell history, process inspection, logs, accidental reuse by other tools, or compromise of the agent runtime, which could directly lead to loss of wallet funds.

Context-Inappropriate Capability

High

• Confidence: 92% confidence
• Finding: This script exposes an admin-style capability: funding the staking contract’s reward pool with ETH and CLAWMEGLE, which is materially different from normal end-user staking actions. In an agent skill advertised for staking-position management, including a reward-funding path can cause an agent to submit high-value approval and deposit transactions on behalf of a user or operator who did not intend to perform treasury-like actions.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The manifest describes staking, claiming, and checking rewards, but this file instead builds approval and reward-deposit transactions that transfer assets into the staking contract. That mismatch is dangerous because an agent selecting this skill for ordinary staking management could be induced to approve token spending and send ETH to a contract, resulting in unintended loss of funds or misuse of treasury assets.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The heartbeat instructs the agent to persist wallet address, staking balances, claim timestamps, and cumulative rewards in a local JSON file without any warning about data minimization, access controls, or secure storage. While this is not a secret-key exposure, it still creates a privacy and operational security risk because local files may be readable by other users, processes, logs, backups, or telemetry systems, revealing portfolio activity and linking identities to on-chain holdings.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README instructs users to place a live Bankr API key in a predictable local file path without any warning about secret handling, file permissions, rotation, or use of a secrets manager. Because this skill can initiate wallet-related actions, compromise of that credential could enable unauthorized access to account functions and downstream financial loss.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README provides direct staking, claiming, and unstaking commands for on-chain transactions but does not warn that these actions are irreversible, may incur gas costs, depend on contract correctness, and can result in loss of funds. In an agent skill context, concise automation-oriented instructions increase the chance that users or agents execute financial actions without adequate confirmation or risk review.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill describes irreversible on-chain operations including staking, claiming, unstaking, and reward deposits, but it does not clearly foreground transaction finality, network/address validation, or the risk of permanent fund loss from wrong parameters. In an agent setting, weak warnings increase the chance of unsafe automation or user misunderstanding before value-moving actions occur.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The direct-wallet instructions mention using a private key but do not clearly warn that it is highly sensitive credential material whose exposure can compromise the entire wallet. Without explicit handling guidance, operators may paste, export, store, or reuse the key insecurely in ways that enable theft.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The guidance encourages free-form natural-language requests for wallet-affecting actions without defining strict allowlists, confirmation requirements, or parameter validation. In an agent setting, this increases the chance of prompt injection, misinterpretation of user intent, or unintended token approvals/transactions being constructed and submitted.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The file documents arbitrary raw transaction submission and approval/staking flows but provides no safety warnings, confirmation requirements, or discussion of irreversible on-chain effects. Because approvals can grant spending power and raw transaction submission is generic, an agent or user could be induced to sign harmful transactions, send assets to the wrong address, or approve excessive allowances.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script requires a raw private key to be supplied via the PRIVATE_KEY environment variable and then uses it directly for signing transactions. Environment variables are easy to leak through shell history, process inspection, CI logs, crash dumps, or inherited subprocess environments, so handling a wallet private key this way increases the risk of credential compromise and unauthorized fund movement.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script triggers an approval and then a staking transaction through Bankr with no explicit confirmation gate, dry-run, or transaction detail review step in the script itself. Because token approvals and staking are irreversible or costly to unwind, a mistaken amount, wrong contract from an overridden environment variable, or unintended invocation could cause loss of control over tokens or funds being locked in the staking contract.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script sends two irreversible on-chain transactions (ERC-20 approval and staking) immediately after basic argument checks, with no preview, confirmation prompt, dry-run, or safety interlock. In an agent skill context, this is more dangerous because an automated caller could trigger real fund movements on mainnet with a supplied PRIVATE_KEY, and the approval step can expose tokens to the configured staking contract before the user has a chance to verify the address and amount.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script submits a live on-chain unstake transaction directly with a private key and no interactive confirmation, dry-run, or explicit safety warning. In an agent-executed context, this increases the chance of accidental or unintended unstaking and automatic reward claiming, which can trigger irreversible asset movements, strategy disruption, tax/accounting consequences, or front-end/operator mistakes.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Step 2: Get Your API Key

1. **Go to [bankr.bot/api](https://bankr.bot/api)**
2. **Create a new API key**
3. **Enable "Agent API" access** (required for transactions)
4. **Copy the key** (starts with `bk_`)

• Confidence: 84% confidence
• Finding: Create a new API key** 3. **Enable "Agent API" access** (required for transactions) 4. **Copy the key** (starts with `bk_`) ### Step 3: Configure the Skill Save your API key: ```bash mkdir -p ~/.cl

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.