ClawHub

TWZRD Trust

Security checks across malware telemetry and agentic risk

Overview

This appears to be a payment trust-check skill that shares transaction context with its own API, with privacy caveats but no evidence of malicious behavior.

Install only if you are comfortable with a third-party trust service receiving seller/payment context. Before use, confirm what wallet addresses and payment details will be sent, and avoid including your own wallet address unless it is necessary for the check.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The trigger list includes broad phrases like 'before paying', 'check seller', and 'trust score' that could cause the skill to activate in situations where the user did not specifically request this service. Over-broad invocation increases the chance that wallet, seller, or payment-intent data is sent to an external service unexpectedly, especially when composed with payment workflows.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs clients to POST seller wallet, service name, price, agent intent, and optionally the user's wallet to a third-party endpoint without a clear upfront privacy warning or consent requirement. This creates a data-sharing risk because transaction intent and counterparty metadata may be sensitive and can be transmitted off-platform without the user realizing it.

VirusTotal

47/47 vendors flagged this skill as clean.

View on VirusTotal