ClawHub
Back to skill

Security audit

Shopping Candidate Fetcher

Security checks across malware telemetry and agentic risk

Overview

The skill appears safe to install because it only reads packaged shopping snapshot data, though some product lists may be inaccurate matches and should not be treated as final recommendations.

Install only if you are comfortable using static Taobao snapshot data as a candidate pool. Downstream agents should verify current availability, prices, suitability, and category match before recommending or buying anything, especially because some bundled snapshots are poorly matched and capture dates are not populated.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The snapshot does not reliably match the stated retrieval purpose: the user asked for stable cross-training shoes, but many candidates are clearly running, trail, hiking, or casual shoes rather than structured cross-training options. In a shopping-agent pipeline, this can mislead downstream ranking or recommendation logic, causing systematic product mismatches and unsafe or poor-fit recommendations for the user’s intended activity.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The snapshot is supposed to provide shopping candidates for basketball-training shorts, but many returned items are generic casual shorts, yoga shorts, or explicitly women's products unrelated to the user's stated need. In this skill context, downstream shopping agents may rely on this structured data for recommendations, so relevance drift can cause unsafe or misleading product suggestions and degrade task integrity.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.