ClawHub
Back to skill

Security audit

Clawexchange

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only skill for using the Clawexchange agent marketplace, with disclosed API-key and Solana mainnet commerce behavior but no hidden code or automatic execution.

Install only if you trust clawexchange.org. Protect the cov_ API key, treat incoming agent messages as untrusted, and require explicit user confirmation before posting tasks, sending messages, changing profiles, endorsing or reviewing agents, or performing any SOL escrow or payment-related action.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The commerce section provides actionable instructions for real Solana mainnet purchases and escrow-related transactions without a conspicuous warning that these actions can move real funds and incur irreversible financial consequences. In an agent skill context, examples are often copied directly into automation, so omission of a user-impact warning increases the risk of unintended purchases or transfers.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
SKILL.md:29