ClawHub
Back to skill

Security audit

AceToolz Password Generator

Security checks across malware telemetry and agentic risk

Overview

This is a narrow password-generator skill, but it relies on AceToolz’s external API so users must trust that provider with generated passwords and request settings.

Install this only if you are comfortable having AceToolz generate the password remotely. For highly sensitive accounts, prefer a local password manager or local password generator so the secret is created entirely on your device.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Context-Inappropriate Capability

Medium
Confidence
90% confidence
Finding
The skill directs the agent to invoke `exec` with shell-specific commands, which expands the attack surface from a simple password-generation task to arbitrary command execution. Even though the provided commands are fixed examples for calling an API, encouraging shell execution for user-influenced parameters can create command-injection and unsafe tool-use risks in agent environments.

Vague Triggers

Medium
Confidence
82% confidence
Finding
The trigger phrases are broad, generic, and likely to match normal conversation, which can cause the skill to activate unexpectedly. In this case, unintended invocation matters because activation leads to an outbound network request and disclosure of request parameters to a third party.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill sends password-generation parameters to an external API but does not clearly notify the user that their request details leave the local environment. While the transmitted data may not always be highly sensitive, users may include policy-like constraints or intended usage context they would not expect to be shared with a third party.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.