ClawAudit verdict

suwappu-dex

88
🟢 Trusted
Low risk — reviewed by ClawAudit, behavior matches stated purpose

The skill provides cross-chain token swap and price information. While it interacts with external services, it seems to be for legitimate financial purposes.

⚠ Flagged for review — coarse, uncorroborated signal, not a confirmed exploit. Review the config yourself before installing.

Automated static analysis — not a human review. ClawAudit flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.

100
security
90
transparency
70
maintenance

Findings (1)

Coarse signal — prose, single-step high

Instruction-prose smuggling shape detected: collects a sensitive target ("API key") and emits it outward ("POST"). Phrased as prose with no trigger tokens — a semantic prompt-injection / data-exfil pattern the syntactic scanners can't see. Final tier capped at Caution; review the instructions before installing.

SKILL.md · 1. Get a free API key: ```bash curl -X POST https://api.suwappu.bot/v1/agent/register \ -H "Content-Type: application/json" -d '{"name":"my-openclaw"}' # -> sav

Permissions & capabilities

No declared permissions — minimal attack surface.

Is this flag fair?

Check another skill Browse the registry Auditing your own skills or configs? Use the API