ClawHub
Back to skill

Security audit

Domain Name Registration For Agents

Security checks across malware telemetry and agentic risk

Overview

This skill is clearly for domain registration, but it can create wallet files, spend USDC, and change live DNS without strong approval guardrails.

Install only if you are comfortable letting an agent use a dedicated, low-balance wallet for domain purchases and DNS administration. Review and pin the external client package, protect wallet files, require confirmation before any wallet creation, payment, registration, DNS edit, or nameserver change, and keep DNS backups for rollback.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill presents a workflow that creates local wallet files, authenticates with a wallet signature, and performs paid, state-changing actions such as domain registration and DNS modification without an explicit upfront warning in the skill description. In an agent context, this increases the risk that a user or calling system invokes the skill without understanding it can persist credentials locally and spend funds or alter production DNS state.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.