ClawHub
Back to skill

Security audit

Homestruk Rent Comps

Security checks across malware telemetry and agentic risk

Overview

This skill is an instruction-only rent-comparison helper whose searches, local property lookup, and saved report fit its stated rental-pricing purpose.

Use this skill when you intentionally want rental pricing analysis for a Massachusetts property. Review what is in ~/.openclaw/shared/properties.json before use, and be aware that generated reports may store addresses, rents, and analysis locally under ~/.openclaw/workspace/properties.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The skill is user-invocable and described with broad trigger language like rent pricing, market rent, comparable properties, rent increases, and what to charge for rent, without clear narrowing conditions. This can cause overbroad auto-selection or invocation on common housing conversations, leading the agent to pull external listing data and perform pricing guidance in situations where the user did not explicitly request this workflow.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill directs the agent to save a full report to a local workspace path without any user notice, consent, or retention guidance. Silent file writes create privacy and persistence risks because property addresses, rent figures, and tenant-related pricing context may be stored on disk unexpectedly and could later be accessed by other tools, skills, or users sharing the environment.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.