ClawHub
Back to skill

Security audit

RealEstate

Security checks across malware telemetry and agentic risk

Overview

This is a real-estate planning helper that uses local calculators and local storage, with no evidence of hidden network access, credential use, or destructive behavior.

Install only if you are comfortable with real-estate and financial planning details being saved locally. Treat outputs as educational support, verify decisions with licensed real-estate, mortgage, and legal professionals, and do not fetch missing helper scripts from untrusted sources.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Description-Behavior Mismatch

Medium
Confidence
78% confidence
Finding
The skill states it will never provide investment advice, yet it advertises `analyze_market.py` and offer-strategy features that can readily cross into investment or financial recommendation territory. In a high-stakes domain like real estate, this mismatch can mislead users about the nature of the guidance and create unsafe reliance on outputs that sound like regulated advice.

Vague Triggers

Medium
Confidence
72% confidence
Finding
The invocation description is broad enough to activate on common mentions of buying, renting, mortgages, or contracts, which can pull the skill into conversations without strong user intent. Because the skill handles sensitive legal and financial topics and stores local data, over-triggering increases the chance of unnecessary data collection, inappropriate advice context, or user confusion about the tool's authority.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.