ClawHub
Back to skill

Security audit

Sports Game Light Tracker

Security checks across malware telemetry and agentic risk

Overview

The skill has a plausible smart-light sports purpose, but it depends on unprovided PowerShell scripts, a Home Assistant token, hidden background execution, and broad force-stop commands.

Install only if you can review or supply the actual game-tracker.ps1 and keeper.ps1 scripts yourself. Use a least-privilege Home Assistant token if available, confirm exactly which light entity can be controlled, avoid hidden background launch unless you explicitly want it, and prefer a stop method that targets only the specific tracker process IDs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Context-Inappropriate Capability

Medium
Confidence
87% confidence
Finding
The skill instructs starting a hidden background PowerShell supervisor process to keep the tracker alive. Hidden persistent processes expand the skill's control beyond the stated purpose of syncing lights to scores, reduce user visibility, and create an avenue for stealthy long-running execution if the pattern is reused or modified.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The stop instructions kill PowerShell processes by command-line pattern matching and use Stop-Process -Force. This is overly broad for the skill's function, can terminate unrelated user or system PowerShell jobs with similar arguments, and grants destructive host process control not necessary for simple light tracking.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The documentation recommends forceful termination of PowerShell processes without clearly warning that other matching processes may be killed. In this context, the skill is a home automation helper, so users would not reasonably expect process-killing behavior, making the instruction disproportionately risky relative to the task.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.