ClawHub
Back to skill

Security audit

Offsite Signal Analyzer

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed SEO/analytics workflow for backlink and AI-referral analysis, with some sensitive business-data handling that fits its stated purpose.

Install only if you want an agent to analyze backlink, referral, analytics, or server-log data for your domain. Review disavow recommendations manually before acting in Google Search Console, and avoid giving the skill broader analytics/log exports than the task needs.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Natural-Language Policy Violations

Medium
Confidence
93% confidence
Finding
The rubric includes 'Foreign-language spam | Yes | If clearly unnatural and irrelevant' as a disavow category, which risks treating non-local-language links as inherently suspicious. In an SEO backlink-analysis skill, that can lead users to wrongly disavow legitimate international, multilingual, diaspora, press, or partner links, causing self-inflicted ranking and referral losses while encoding biased decision-making into the workflow.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.