ClawHub
Back to skill

Security audit

Smzdm Deals

Security checks across malware telemetry and agentic risk

Overview

This is a public deal-search helper with expected outbound SMZDM requests, but its documentation overstates monitoring features and the script may show demo deals as real results.

Install only if you are comfortable with shopping search terms being sent to SMZDM. Treat outputs as a lightweight helper, not verified price intelligence, because some results may be demo/mock data and the advertised real-time alerts or historical-low checks are not actually implemented.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill declares runtime requirements including curl and python3 and advertises real-time monitoring of external deal data, but it does not declare any explicit permissions for network access. This creates a transparency and governance gap: users and platforms cannot accurately assess or constrain external communication, which is especially relevant for a monitoring skill that may fetch data frequently.

Vague Triggers

Medium
Confidence
78% confidence
Finding
The invocation examples are written as broad natural-language shopping requests, without clear trigger boundaries or explicit skill invocation patterns. In environments with multiple skills or tool-routing, this increases the chance of unintended activation and silent external fetching or monitoring when a user is making a general conversational request.

Missing User Warnings

Low
Confidence
81% confidence
Finding
The skill markets real-time monitoring, category tracking, historical price checks, and immediate BUG-price alerts, but it does not clearly warn users that their requests may trigger external data fetching and ongoing monitoring behavior. This is a disclosure problem that can surprise users and reduce informed consent, particularly for a skill that may poll third-party services or set persistent alerts.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal