ClawHub
Back to skill

Security audit

Maestro Api

Security checks across malware telemetry and agentic risk

Overview

The skill is coherent for Maestro API payments, but it asks for wallet signing or raw private-key access and can spend USDC with limited payment controls.

Install only if you are comfortable letting an agent sign wallet messages and purchase Maestro API credits. Use a dedicated low-balance wallet or constrained signer, verify the endpoint, network, payee, asset, and exact USDC amount yourself, and require approval for every paid request.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly asks for a `PRIVATE_KEY` or wallet signer to complete SIWX signing and x402 payment, but it does not include a clear warning that these are highly sensitive credentials or constrain how they should be provided and handled. In this context, the skill also authorizes on-chain payments and reuse of JWTs, so requesting signing capability without strong guardrails increases the risk of credential exposure, unintended transactions, or overbroad wallet access.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.