ClawHub

pumpfun-sniper

Security checks across malware telemetry and agentic risk

Overview

The skill mostly does what it advertises, but its web UI and paid payment flow have enough security and disclosure gaps that users should review it before installing.

Install only if you are comfortable sending token addresses and a Helius API key to external crypto data providers. Do not let an agent run the x402 pay command without explicit approval, treat the hosted API as paid despite the free metadata, and avoid using the web UI with untrusted tokens until the innerHTML rendering is fixed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)

Tainted flow: 'FACILITATOR' from os.environ.get (line 25, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
if not ph:
        return False
    try:
        r = requests.post(f"{FACILITATOR}/verify",
                          json={"payment": ph, "paymentRequirements": payment_requirements()["accepts"][0]},
                          timeout=10)
        return r.status_code == 200 and r.json().get("isValid", False)
Confidence
94% confidence
Finding
r = requests.post(f"{FACILITATOR}/verify", json={"payment": ph, "paymentRequirements": payment_requirements()["accepts"][0]}, timeout=10)

Tainted flow: 'FACILITATOR' from os.environ.get (line 25, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Content
def settle_payment(ph: str) -> dict:
    try:
        r = requests.post(f"{FACILITATOR}/settle",
                          json={"payment": ph, "paymentRequirements": payment_requirements()["accepts"][0]},
                          timeout=10)
        return r.json() if r.status_code == 200 else {}
Confidence
94% confidence
Finding
r = requests.post(f"{FACILITATOR}/settle", json={"payment": ph, "paymentRequirements": payment_requirements()["accepts"][0]}, timeout=10)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill declares environment-variable use but does not explicitly declare network permission even though its documented behavior depends on external API calls and hosted endpoints. This creates a transparency and policy-enforcement gap: an agent or reviewer may approve the skill based on incomplete capability disclosure while it still sends data off-box and interacts with third-party services.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding
The skill is presented as a token safety scorer, but the described implementation also introduces paid x402/USDC payment flows and additional hosted functionality not reflected in the core purpose. This mismatch is dangerous because users and agents may invoke the skill expecting read-only analysis, while actually triggering financial interactions and third-party processing with different trust, privacy, and authorization implications.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
This is a real DOM XSS risk. The page builds large HTML fragments with innerHTML using multiple untrusted values from the server response (for example d.token.symbol, d.token.name, d.signals, d.verdict, and breakdown fields), so if the backend or any upstream data source returns attacker-controlled HTML, script-capable markup can execute in the user's browser. In this skill's context, the application consumes token metadata and social-linked ecosystem data from external crypto sources, which are especially untrusted and attacker-influenceable, making exploitation more plausible than in a closed/internal app.

Unpinned Dependencies

Low
Category
Supply Chain
Content
fastapi>=0.110.0
uvicorn>=0.29.0
requests>=2.28.0
aiofiles>=23.2.0
Confidence
95% confidence
Finding
fastapi>=0.110.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
fastapi>=0.110.0
uvicorn>=0.29.0
requests>=2.28.0
aiofiles>=23.2.0
Confidence
95% confidence
Finding
uvicorn>=0.29.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
fastapi>=0.110.0
uvicorn>=0.29.0
requests>=2.28.0
aiofiles>=23.2.0
Confidence
95% confidence
Finding
requests>=2.28.0

Unpinned Dependencies

Low
Category
Supply Chain
Content
fastapi>=0.110.0
uvicorn>=0.29.0
requests>=2.28.0
aiofiles>=23.2.0
Confidence
91% confidence
Finding
aiofiles>=23.2.0

Known Vulnerable Dependency: fastapi — 3 advisory(ies): CVE-2021-32677 (Cross-Site Request Forgery (CSRF) in FastAPI); CVE-2021-32677 (FastAPI is a web framework for building APIs with Python 3.6+ based on standard ); CVE-2024-24762 (FastAPI is a web framework for building APIs with Python 3.8+ based on standard )

High
Category
Supply Chain
Confidence
88% confidence
Finding
fastapi

Known Vulnerable Dependency: uvicorn — 4 advisory(ies): CVE-2020-7694 (Log injection in uvicorn); CVE-2020-7695 (HTTP response splitting in uvicorn); CVE-2020-7694 (This affects all versions of package uvicorn. The request logger provided by the) +1 more

High
Category
Supply Chain
Confidence
90% confidence
Finding
uvicorn

Known Vulnerable Dependency: requests — 10 advisory(ies): CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +7 more

High
Category
Supply Chain
Confidence
93% confidence
Finding
requests

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal