TWZRD Preflight for ClawRouter

• Outcome: Review
• Latest audit: Jun 13, 2026 · 11:49 PM UTC
• Version: 0.1.2

Overview

This skill is a coherent payment-preflight prototype, but its payment gate and receipt checks fail open in ways users should review before relying on it for spend decisions.

Install only if you treat this as a prototype or advisory gate, not as a fail-closed payment-control system. Use a dedicated low-balance wallet, keep spend limits small, pass the real seller wallet when available, and do not rely on the included receipt helper as proof that your own paid receipt was validated.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill embeds executable examples that use outbound network access and environment-derived configuration (`CLAWROUTER_PROXY_BASE`) but does not declare corresponding permissions. That creates a transparency and policy-enforcement gap: hosts or users may treat the skill as lower-risk than it really is, while the code can still transmit data externally and interact with local/remote services.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The documentation states that receipt verification is performed live, but the included `verifyReceiptIfAny` implementation only prints instructions and returns success. This can cause downstream agents or operators to believe payment proofs were validated when they were not, enabling acceptance of unverified or forged receipts and weakening the trust gate the skill claims to provide.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The changelog asserts a 'live receipt verification step' was added, but the code still contains a non-validating stub that always succeeds. Security-sensitive release notes that overstate protections can mislead integrators into deploying the skill with a false sense of assurance, undermining payment integrity and auditability.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The function signature and comments imply it verifies the caller-provided receipt, but it ignores the input and instead fetches and validates a public sample receipt. This can create a false sense of security: an agent may treat an unverified real payment receipt as valid because the verification step always tests known-good data rather than the actual artifact from the transaction.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The skill repeatedly states that TWZRD preflight is the mandatory gate before any ClawRouter or BlockRun spend, yet network errors, timeouts, and non-2xx responses are implemented as implicit allow decisions. In a payment-gating security control, fail-open behavior lets an attacker or transient outage bypass the trust check entirely and proceed to spend despite the documented 'decision=block → abort' rule.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.