ClawAudit verdict
31third-safe-rebalancer
The skill installs a package and accesses sensitive financial data. The risk comes from the potential misuse of the package installation capability.
⚠ Flagged for review — coarse, uncorroborated signal, not a confirmed exploit. Review the config yourself before installing.
Automated static analysis — not a human review. ClawAudit flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.
Permission integrity
package_install
Findings (3)
Possible hardcoded credential
dist/tests/rebalance.test.js · prose · downgraded · ApiKey: 'test-key
Long base64 string (100+ chars) — likely obfuscated payload
abi/AssetUniversePolicy.json · prose · downgraded · 0x60a0604052346100475761001a6100146101d2565b906105b5565b61002261004c565b6119a361
Accesses sensitive environment variables
index.ts · prose · downgraded · process.env.TOT_API_KEY
Permissions & capabilities
No declared permissions — minimal attack surface.
package_install Is this flag fair?
Thanks — recorded.