ClawHub
Back to skill

Security audit

Monad Dev Tool Free

Security checks across malware telemetry and agentic risk

Overview

The skill is a Monad testnet development helper, but it needs review because it directs agents through wallet private-key handling and uses broad activation guidance.

Review this before installing if you may work with real or reusable wallets. Use only dedicated testnet keys, do not paste or expose valuable private keys to the agent, keep .env out of version control, and confirm any deployment or verification command before it runs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger condition is broad enough to activate on generic development, debugging, or deployment requests, which can cause the skill to engage outside its intended Monad-specific scope. Because the skill exposes exec/write capabilities and includes wallet/deployment workflows, over-triggering increases the chance of unintended command execution or collection/handling of sensitive blockchain credentials.

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill instructs users to generate wallets and persist private keys, including suggesting storage in `.env`, but does not prominently warn that private keys are highly sensitive secrets that must never be exposed, logged, committed, or shared with the agent. In a skill with exec/write capabilities, this omission materially raises the risk of credential disclosure, accidental persistence, or unsafe handling that could compromise blockchain accounts if users reuse practices beyond the stated testnet scope.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.