ClawHub
Back to skill

Security audit

jinn-node-free

Security checks across malware telemetry and agentic risk

Overview

The skill is not clearly malicious, but it asks users to run a funded blockchain-node workflow with local secrets and broad agent authority that needs careful review.

Review this before installing or invoking it. Only use it in a dedicated workspace, verify the actual repository and commands before running setup, use least-privilege API keys, keep .env and .operate out of version control and prompts, and do not fund or stake more ETH/OLAS than you are prepared to lock until you have independently confirmed withdrawal and recovery paths.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Description-Behavior Mismatch

Medium
Confidence
80% confidence
Finding
The skill is presented as a narrowly scoped blockchain worker helper, but later claims broad file processing, API integration, search, and command execution capabilities. This scope inflation can cause an agent or operator to invoke the skill in unrelated contexts, increasing the chance of overbroad tool use, unsafe command execution, or unintended access to local files and external services.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The description uses very broad language about helping with development scenarios, reusable templates, and standardized workflows, which can match many unrelated user requests. In an agentic environment, that broad activation surface makes accidental invocation more likely, potentially granting the skill's `exec`, `read`, and `write` tools in contexts outside its intended blockchain-node setup workflow.

Vague Triggers

Low
Confidence
82% confidence
Finding
A generic free-form `input` field with no trigger or schema constraints permits arbitrary instructions to be passed into a skill that advertises command execution and file access. In practice, this can expand the skill from a bounded node-management helper into a general-purpose executor, raising prompt-injection and misuse risk.

Credential Access

High
Category
Privilege Escalation
Content
yarn install
# ...
# 2. 配置环境变量
cp .env.example .env
# 编辑 .env，填入：
# RPC_URL=https://base-mainnet.g.alchemy.com/v2/YOUR_KEY
# OPERATE_PASSWORD=MySecurePass123
Confidence
93% confidence
Finding
.env

External Script Fetching

Low
Category
Supply Chain
Content
| 错误场景 | 原因 | 处理方式 |
|---:|---:|---:|
| `yarn not found` | Node.js 20+ 未启用 corepack | 运行 `corepack enable`（随 Node 20+ 附带） |
| `poetry not found` | Python 包管理器未安装 | 执行 `curl -sSL https://install.python-poetry.org \| python3 -` |
| Python 3.12+ 兼容错误 | 使用了不支持的 Python 版本 | 通过 pyenv 安装 3.11：`pyenv install 3.11.9` |
| Setup 卡住无输出 | 等待钱包资金到账 | 向显示的钱包地址发送 ETH 和 OLAS，确认到账后重新运行 `yarn setup` |
| Gemini 认证失败 | API Key 无效或 OAuth 未登录 | 运行 `npx @google/gemini-cli auth login` 完成 OAuth |
Confidence
91% confidence
Finding
curl -sSL https://install.python-poetry.org \| python

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.