Security audit

4Claw Mint

Security checks across malware telemetry and agentic risk

Overview

The skill appears to mint tokens as described, but it gives a remote HTTP signer service unsafe control over wallet-signed blockchain transactions.

Review carefully before installing or running. Use only a fresh low-balance wallet, do not pass a main wallet private key on the command line, verify the exact contract address before any transaction, and prefer a trusted HTTPS or self-hosted signer that enforces a fixed allowlisted contract and authenticated access.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 85% confidence
Finding: The skill documentation instructs use of environment-backed secrets and private-key-driven operations, but it declares no permissions or security boundaries. In an agent ecosystem, hidden env access and undeclared secret handling increase the chance that a caller or runtime grants broader access than users expect, especially when blockchain private keys and signer keys are involved.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill presents itself as a minting utility, but it also describes operating a signing service that can issue mint authorizations, exposes operational details via HTTP, and requires highly sensitive private keys. That mismatch is dangerous because users may invoke or install the skill expecting a simple token action while actually enabling infrastructure that can authorize mints for arbitrary wallets or leak operational metadata useful to attackers.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The script allows an arbitrary server URL to be supplied and then transmits the wallet address to that endpoint. In a wallet/minting skill, this expands trust to any caller-chosen external service, enabling tracking, workflow manipulation, and phishing-style redirection beyond the stated purpose of interacting with the 4Claw mint service.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The script trusts the remote server to provide the contract address and immediately signs a transaction against that contract using the user's private key. A malicious or compromised server can return an attacker-controlled contract whose mint function performs harmful logic, causing fund loss, token approvals, or other unintended on-chain actions under the user's authority.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The instructions explicitly tell users to run a script with a wallet private key, but they do not warn about credential sensitivity, secure storage, shell history leakage, process-list exposure, or the risk of theft if the key is reused. In blockchain contexts, compromise of a private key can directly lead to irreversible loss of funds and unauthorized transactions, making this especially dangerous.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Accepting the private key as a command-line argument exposes it to shell history, process listings, logs, and orchestration layers that may capture invocation arguments. In the context of an agent skill that mints on-chain assets, this is especially dangerous because compromise of the key gives full control over the wallet, not just this mint action.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The POST endpoint will generate a valid mint signature for any caller who supplies a syntactically valid wallet address, with no authentication, authorization, rate limiting per client, or proof that the requester controls the destination wallet. In the context of a token-minting signer service, this effectively exposes privileged signing capability to the public internet and allows automated abuse at scale, while the in-memory cooldown is trivial to bypass via server restarts and does not provide durable protection.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.