ClawHub

Token Profiler

Security checks across malware telemetry and agentic risk

Overview

This skill is an instruction-only token lookup helper that makes a disclosed network call and does not request local files, credentials, persistence, or account-changing access.

Install this only if you are comfortable sending token names or contract addresses to the declared third-party endpoint. Use it for public token lookups, not private wallet details, API keys, seed phrases, confidential trading strategy, or as the sole basis for financial decisions.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The trigger phrase "crypto data" is overly broad and can cause this skill to activate for many generic cryptocurrency questions outside its stated purpose of token profiling. Over-broad routing can divert user requests to an untrusted external service unnecessarily, increasing data exposure and creating opportunities for prompt/skill hijacking via unintended invocation.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The activation guidance "general data" is ambiguous and fails to clearly bound when the skill should be used. In an agent environment, ambiguous invocation rules can cause over-selection of this skill for broad market or crypto questions, sending more requests than necessary to the external endpoint and reducing control over data flow and tool choice.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal