ClawHub
Back to skill

Security audit

BayHustleLocal

Security checks across malware telemetry and agentic risk

Overview

This is a non-executable Bay Area parking and resale research skill, with browsing and local-note use disclosed but needing careful user scoping.

Install only if you want the agent to research local parking and resale opportunities using web and marketplace browsing. Before use, tell the agent which sites and local notes it may consult, avoid private or logged-in pages unless intentional, and verify that any permit resale, sublet, or arbitrage idea complies with local rules and platform terms.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger conditions are broad enough to activate this skill for generic resale, side-gig, or local opportunity queries, which can cause the agent to use scraping, local data access, and parking/permit arbitrage workflows outside a narrowly intended context. In this skill, that matters because the workflow explicitly includes Craigslist/Facebook/Nextdoor browsing and use of workspace or memory data, increasing the chance of unnecessary data access and policy-sensitive assistance.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill directs the agent to scrape third-party listing sites and check workspace files or memory without any user-facing notice, consent boundary, or minimization guidance. That creates a real risk of collecting or surfacing sensitive, stale, or unauthorized data from local context and external platforms in response to an otherwise simple research request.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.