ClawHub
Back to skill

Security audit

converly

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent Converly setup guide, but users should be aware it can change live ad tracking and send conversion data to ad platforms.

Install only if you intend the agent to configure live conversion tracking. Confirm the exact site, form, destination platform, and conversion action before publishing, and ensure your privacy notices and consent handling allow sending hashed identifiers or click IDs to advertising platforms.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Confidence
87% confidence
Finding
The README explicitly states the agent can publish conversion flows and validate them using a real test conversion, but it does not warn that these actions can modify live production tracking and create real records in ad platforms or analytics systems. In a skill designed to automate ad-conversion setup, that omission increases the chance an agent will take irreversible or misleading actions without clear user confirmation, potentially polluting reporting, triggering automations, or altering active campaign measurement.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The skill description is intentionally expansive and triggers on many common marketing and tracking intents, including cases where the user may not explicitly request Converly. That can cause the agent to over-invoke this skill, steering users into external auth flows, website instrumentation, and ad-platform configuration changes without a narrowly scoped request.

Missing User Warnings

Medium
Confidence
84% confidence
Finding
The file instructs users to send hashed first-party data such as email addresses for Google Enhanced Conversions, but it does not explicitly warn about privacy, consent, retention, or regulatory obligations. In an ad-tracking skill, omission of these warnings can lead users to enable transmission of personal data to advertising platforms without ensuring lawful basis, notice, and consent, creating compliance and user-trust risk.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.