claw2ui

Security checks across malware telemetry and agentic risk

Overview

This skill openly publishes user-approved dashboards or reports to a public URL and gives clear safety warnings, so it is acceptable with care around sensitive data.

Install only if you want agents to create and publish pages through Claw2UI. Before approving any publish, review the exact content, avoid secrets, credentials, PII, internal endpoints, or regulated data, and use TTL for temporary or sensitive reports.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger list is unusually broad and includes generic phrases like 'weekly report', 'show me stats', and 'create a webpage', which can cause the skill to activate for many ordinary requests. Because this skill publishes content to a public URL, over-broad invocation increases the chance of unintended data exposure or accidental use in contexts where the user did not clearly intend public publication.

VirusTotal

57/57 vendors flagged this skill as clean.

View on VirusTotal