ClawHub
Back to skill

Security audit

DropClaw Store

Security checks across malware telemetry and agentic risk

Overview

The skill appears to do what it says: store and retrieve encrypted files through DropClaw, with no evidence of hidden execution or data theft.

Install is reasonable if you want permanent encrypted file storage and understand the tradeoffs. Only upload files suitable for long-term retention, keep the encryption key private and backed up, inspect returned metadata before reuse, verify the payment destination, and review any optional SDK or MCP package before installing it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill explicitly promotes permanent on-chain storage but omits a clear warning that blockchain-backed publication is effectively irreversible and may create long-term privacy, compliance, and data-retention risks. Even though the file is client-side encrypted, encrypted blobs and associated metadata can remain publicly or permanently accessible indefinitely, and future key compromise or metadata leakage could expose sensitive information.

Missing User Warnings

Low
Confidence
84% confidence
Finding
The retrieval flow tells users to POST the skill file JSON to the service without explaining that this may disclose file identifiers, hashes, sizes, payment references, or other metadata to the remote endpoint. While this may be necessary for retrieval, the lack of transparency can cause users to unknowingly transmit metadata that could support tracking, correlation, or disclosure of sensitive file relationships.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal