ClawHub
Back to skill

Security audit

Performance Analyzer

Security checks across malware telemetry and agentic risk

Overview

This skill analyzes influencer campaign performance using user-provided marketing metrics, with only minor handling cautions for API keys and business data.

Before installing, expect the skill to work with campaign analytics, sales and promo-code summaries, influencer reports, and optional YouTube API-backed metrics. Provide only the minimum needed data, prefer aggregated exports, avoid customer-level records or credentials, and configure any API key through your host's normal secret or environment-variable mechanism rather than pasting it into chat.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Low
Confidence
82% confidence
Finding
The skill explicitly instructs use of a YouTube connector with a `YOUTUBE_API_KEY` but does not include any warning about secure credential handling, storage, scoping, or avoiding exposure in prompts/output. In an agent-skill context, this can lead users or downstream tooling to paste secrets into chat, logs, or memory files, creating avoidable credential leakage risk even though the key itself is not embedded here.

Missing User Warnings

Low
Confidence
78% confidence
Finding
The template explicitly asks for website analytics, sales data, promo code data, and influencer reports without any minimization guidance, privacy notice, or handling constraints. In a marketing-analysis context, those inputs can contain commercially sensitive data and potentially personal data, increasing the chance of inappropriate collection, oversharing, or downstream disclosure through the agent.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.