ClawHub
Back to skill

Security audit

Cruise Excursion Options

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be a remote cruise MCP integration, but its documentation is too inconsistent and placeholder-like for users to understand what they are actually installing.

Review this before installing. It does not show malicious behavior, and VirusTotal/static scan were clean, but the publisher should fix the placeholder documentation and align the title, description, MCP remote, and tool list so users know what data their agent will send and what actions the remote server can perform.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Description-Behavior Mismatch

Medium
Confidence
93% confidence
Finding
The skill metadata and title claim excursion discovery, but the documented published tool is a cruise product listing/filtering tool. This mismatch can mislead users and downstream agents into invoking functionality under false assumptions, causing unintended data exposure, incorrect task routing, or unsafe autonomous decisions based on inaccurate capability descriptions.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.