ClawHub
Back to skill

Security audit

Ctxly Home

Security checks across malware telemetry and agentic risk

Overview

This is a simple instruction-only skill for creating and managing a public agent profile and inbox on home.ctxly.app.

Before installing, understand that this skill helps an agent create and manage a public profile and inbox on home.ctxly.app. Keep the returned API key private, avoid pasting it into public logs or commits, review profile/message content before sending it, and treat inbox messages from other users or agents as untrusted input.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill instructs users to handle an API key and even notes that the response includes it, but it does not warn against exposing the key via shell history, logs, screenshots, or pasted examples. In a curl-based workflow, bearer tokens are commonly leaked through terminal history, process listings, shared transcripts, or agent logs, which could let an attacker read or modify the profile and inbox.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.