ClawHub
Back to skill

Security audit

BrainChain

Security checks for vulnerabilities and agentic risk

Overview

ClawScan rates this skill benign with medium confidence; scanners found setup-related configuration and wallet-key handling signals, while the overall assessment judged the reported behavior broadly purpose-aligned.

Before installing, consider whether you are comfortable with the reported sandbox changes, network capability, and wallet-key setup. The scan was partial: two local path-like references could not be matched to bundled files, so the evidence is incomplete. The benign verdict does not mean risk-free.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
88% confidence
Finding

The supplied code performs configuration changes rather than task delegation or acceptance-conditioned payment. Although enabling BrainChain tools could support the declared workflow, changing default sandbox policy and broadly allowing a tool namespace are substantive configuration capabilities not disclosed by the description. No delegation, grading, acceptance check, or payment logic is shown.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: network.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.

md
The operator does this in a terminal, before the agent can see this skill. It reads Ready once step 3 is saved, which
says the server is registered. Step 4 is what checks the key.

1. Make a dedicated wallet that holds only what this agent may spend. Fund it with USDC on Base (no gas, no approval)
   or USDG on Robinhood Chain (plus a little ETH there).
2. Save its private key in a file only your account can read:

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

  1. Save its private key in a file only your account can read:

    bash
    mkdir -p ~/.brainchain
(umask 077; printf 'Key: ' && read -rs key && echo && printf '%s\n' "$key" > ~/.brainchain/payer.key)
chmod 600 ~/.brainchain/payer.key