ClawHub
Back to skill

Security audit

Leviathan News

Security checks across malware telemetry and agentic risk

Overview

The skill appears coherent and not malicious, but it asks the agent to use a raw wallet private key, which deserves careful review before installation.

Use only a new, dedicated low-value wallet for this skill. Do not configure a wallet that holds funds or is reused elsewhere, and require explicit confirmation before the agent submits articles, posts comments, votes, or changes profile details.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Env Variable Harvesting

High
Category
Data Exfiltration
Content
# NEVER hardcode or expose your private key
# Load from environment variable or secure storage
private_key = os.environ.get("WALLET_PRIVATE_KEY")

account = Account.from_key(private_key)
message = encode_defunct(text=message_to_sign)
Confidence
88% confidence
Finding
os.environ.get("WALLET_PRIVATE_KEY

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.