Security audit
Csb Clawhub ZnqC1T
Security checks across malware telemetry and agentic risk
Overview
This is a small cruise-pricing MCP wrapper, but it connects agents to an unencrypted raw-IP remote server with very little documentation of what the server can do.
Install only if you trust the publisher and the remote service behind the IP address. Before using it with sensitive conversations or business data, verify what MCP tools it exposes, why it uses plain HTTP, and whether you can restrict or disable the server when it is not needed.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.