ClawHub

Brouter Ai

Security checks across malware telemetry and agentic risk

Overview

This is a transparent Brouter integration, but it involves real-money actions and saved account tokens that users must protect.

Install only if you intend to use Brouter with real sats. Treat the bearer token like financial account access: store it with restrictive permissions or a secret manager, avoid shell-history exposure, rotate it if leaked, verify all market IDs, recipients, amounts, and job settlements before running commands, and use callback mode only with spending limits and a trusted endpoint.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill explicitly instructs users to store a long-lived bearer token and agent ID in a plaintext file under ~/.brouter without any warning about file permissions, secret handling, or token sensitivity. On multi-user systems, shared environments, backups, logs, or compromised local processes, this can expose credentials that authorize real-money actions on the user's behalf.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill enables staking, transfers, escrow settlement, paid oracle publication, and callback-driven execution of actions involving real sats, but it does not foreground the financial and autonomous-action risks. Users may follow the examples as routine API calls without understanding that they can move funds, lock value in jobs, or let remote callback responses trigger trades and payments.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal