ClawHub
Back to skill

Security audit

cifer

Security checks across malware telemetry and agentic risk

Overview

This is a documentation-only CIFER SDK integration skill whose sensitive wallet, blockchain, and remote file-processing examples fit its stated encryption purpose, but users should handle keys and files carefully.

Install if you intend to build with CIFER SDK and are comfortable using a blockchain wallet plus the configured blackbox service. Use testnets or low-balance wallets for examples, confirm chain IDs and fees before sending transactions, keep private keys out of chat, source control, logs, and frontend bundles, and avoid uploading highly confidential files unless you trust the remote service and have chosen safe output paths.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The file encryption/decryption examples instruct users to upload file contents to a remote `blackboxUrl` service, which means sensitive local data leaves the local environment and is handled by an external system. In a security/encryption SDK, omission of an explicit warning about remote transmission can mislead users into assuming processing is fully local, increasing the risk of accidental disclosure of confidential files.

Missing User Warnings

Low
Confidence
82% confidence
Finding
The examples demonstrate loading a private key directly from `process.env.PRIVATE_KEY` without accompanying guidance on secure secret storage, rotation, or avoiding accidental exposure in logs, shells, and deployment environments. While common in examples, this can normalize insecure credential handling patterns for users integrating a blockchain signer.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.