ClawHub

HumanNFT

Security checks across malware telemetry and agentic risk

Overview

This skill is transparent about connecting to HumanNFT, but it gives an agent real-money NFT trading authority without clear approval gates.

Install only if you intentionally want an agent to interact with a real HumanNFT wallet. Use a dedicated low-balance wallet, verify any external MCP package before running it, keep the API key revocable, and require explicit approval for every signature, mint, buy, list, cancel, price update, transfer, and webhook registration.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Vague Triggers

Medium
Confidence
97% confidence
Finding
The trigger list is broad enough that ordinary user requests containing terms like "humannft" or generic human-NFT phrasing could invoke the skill without clear intent to trade assets. In a skill that can initiate wallet registration, on-chain transactions, and marketplace actions, overbroad activation materially increases the chance of unintended financial behavior.

Vague Triggers

Medium
Confidence
98% confidence
Finding
The usage conditions include catch-all criteria such as "Agent wants to invest in human NFTs autonomously" and "Any task involving the HumanNFT marketplace," which authorize activation in vague circumstances. Because this skill is tied to real ETH on Base mainnet and trading actions, ambiguous invocation can lead directly to unauthorized or insufficiently consented financial operations.

Natural-Language Policy Violations

High
Confidence
99% confidence
Finding
The instruction that the agent may "invest in human NFTs autonomously" explicitly promotes autonomous financial trading without user opt-in. In the context of real on-chain purchases and listings, this creates a clear risk of unauthorized asset acquisition, fund loss, and actions that exceed the user's intent or risk tolerance.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal