oathe
Oathe Security Badge

Is imthatcarlos/clawdvine-skill-latest safe?

Use with caution. imthatcarlos/clawdvine-skill-latest is not clearly unsafe, but the audit flagged risks to review before you install it. Oathe's behavioral security audit gave the clawdvine-skill-latest skill by imthatcarlos a trust score of 73/100 with 5 findings (2 high). Report updated

https://github.com/openclaw/skills/tree/main/skills/imthatcarlos/clawdvine-skill-latest

73
CAUTION

Is imthatcarlos/clawdvine-skill-latest safe to install?

This ClawdVine skill appears legitimate for AI video generation but involves high-risk cryptocurrency operations including private key handling and payment transactions. While not malicious, it creates significant attack surface for financial exploitation.

What security issues were found in imthatcarlos/clawdvine-skill-latest?

Category Scores

Prompt Injection 90/100 · 30%
Data Exfiltration 70/100 · 25%
Code Execution 70/100 · 20%
Clone Behavior 95/100 · 10%
Canary Integrity 100/100 · 10%
Behavioral Reasoning 60/100 · 5%

Findings (5)

HIGH Cryptocurrency Private Key Handling -20 ▶

The skill instructs agents to handle EVM private keys through environment variables and perform cryptocurrency transactions. This creates significant risk for user funds and wallet security.

HIGH Financial Transaction Capabilities -25 ▶

The skill enables agents to make real cryptocurrency payments via x402 protocol, which could result in unauthorized financial transactions or loss of user funds if exploited.

MEDIUM Executable Cryptocurrency Scripts -15 ▶

Contains JavaScript files that perform wallet operations, API calls, and cryptocurrency transactions. These scripts could be executed by agents with access to user credentials.

MEDIUM External API Communications -10 ▶

Makes API calls to external ClawdVine services which could potentially exfiltrate data or enable tracking of user activities and wallet addresses.

MEDIUM External Package Dependencies -15 ▶

Depends on external npm packages for blockchain operations that are downloaded from public repositories, creating supply chain risk.

Should I install imthatcarlos/clawdvine-skill-latest?

Oathe's verdict for imthatcarlos/clawdvine-skill-latest is CAUTION with a trust score of 73/100. Recommendation: Install with caution.