ClawHub
Back to skill

Security audit

猫眼电影个性化推荐

Security checks across malware telemetry and agentic risk

Overview

This appears to be a coherent recommendation skill that stores local viewing preferences and can send reports to Feishu, with privacy considerations users should understand.

Install only if you are comfortable keeping viewing preferences in a local profile file and sending recommendation reports through Feishu. Review profile.json for sensitive details, verify the Feishu destination, and avoid adding preferences you would not want included or inferred in shared reports.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The README instructs users to create a detailed viewing-preference profile and then send recommendation reports to Feishu, but it does not warn users that these profiles may contain sensitive behavioral preferences and could be transmitted to third-party services. Because the workflow explicitly combines local preference data, LLM processing, and external message delivery, users may unknowingly expose personal data beyond what they expect.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill says the AI will update profile.json when the user asks to add viewing preferences, but it does not clearly warn that this is a persistent local modification to a personal preference file. Persistent writes can unexpectedly store sensitive taste/profile data and create integrity or privacy issues if the user believes the change is only conversational.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill is designed to push recommendation reports to Feishu, which may include user preference signals and inferred interests, but it does not clearly disclose that this information leaves the local agent context and is transmitted to an external messaging service. That omission undermines user consent and may expose sensitive profiling data through a third-party channel.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.