ClawHub
Back to skill

Security audit

Zapper Api

Security checks across malware telemetry and agentic risk

Overview

This skill is a read-only Zapper API helper that matches its stated DeFi lookup purpose, with normal privacy considerations around wallet addresses and API keys.

Install only if you are comfortable sending queried wallet addresses and lookup activity to Zapper. Use a dedicated Zapper API key, keep ~/.config/zapper/addresses.json private, and pass a specific address when you do not intend to query every configured wallet.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill declares it requires an environment variable and is explicitly designed to query an external API, but the metadata does not declare permissions for access to secrets/environment and outbound network use. This creates a transparency and governance gap: users and platforms may not realize the skill can read API keys and transmit data externally, increasing the risk of unintended secret handling and data exfiltration through normal operation or future code changes.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill encourages users to submit wallet addresses and then queries Zapper for balances, NFTs, DeFi positions, and transaction history, but it does not clearly warn that this information is sent to a third-party API. Wallet addresses are persistent identifiers that can reveal sensitive financial activity and cross-chain holdings, so omitting a privacy disclosure can lead to users unknowingly exposing personal financial metadata to an external service.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The reference documents wallet portfolio, NFT, and transaction-history queries that send user wallet addresses and time-bounded activity data to Zapper, a third-party service, but it does not warn about the privacy implications or advise obtaining user consent. Wallet addresses are pseudonymous rather than anonymous, and transaction-history lookups can reveal sensitive financial behavior, so omitting disclosure can cause unintentional privacy leakage in agent use.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill sends wallet addresses and, for transaction queries, recent transaction-history parameters to Zapper's third-party API without any explicit user-facing consent or privacy notice. In this skill context, addresses are the primary user data being processed, so silent transmission can expose sensitive financial profiling data and is a real privacy/security concern even though the behavior is functionally required.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.