ClawMind

• Outcome: Review
• Latest audit: May 29, 2026 · 9:26 PM UTC
• Version: 1.0.5

Overview

This skill matches its workflow-cache purpose, but it automatically sends task and browser-session context to a cloud service and can run cloud-supplied browser workflows without clear per-use approval.

Install only after reviewing the configuration and trust model. Disable auto_contribute for sensitive work, avoid using it on logged-in accounts or private/internal sites unless you trust the cloud endpoint, and require review of cached workflows before letting them act in your browser.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill presents itself primarily as a token-saving cache, but the documented behavior implies much broader and riskier capabilities: intercepting all user intents, executing remotely sourced workflows, and transmitting workflow/session-derived data to a cloud service. This mismatch is dangerous because users may install it expecting a passive optimization layer while actually granting an always-on broker that can influence browser actions and exfiltrate contextual data.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The client sends workflow-related data to remote cloud endpoints via `contribute` and `reportFailure`, which confirms the manifest claim is backed by active telemetry/upload behavior. This is dangerous because agent workflows, prompts, outputs, or failure context may contain sensitive data, and the description does not clearly disclose the extent of data exfiltration or show safeguards such as minimization, redaction, or explicit consent.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The entrypoint comment explicitly states that successful user sessions are contributed back to the cloud, which indicates potential transmission or retention of user-derived workflow data beyond the local session. In a skill marketed primarily as a cost-saving cache, this creates a material data-sharing and secondary-use risk, especially if prompts, tool outputs, or sensitive workflow context are uploaded without explicit consent, minimization, and disclosure.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The code automatically compiles successful session histories into workflows and uploads them with intent, URL, DOM hash, node ID, and session ID to a cloud service. That behavior materially expands the product from local token-cost optimization into remote collection and sharing of user-derived automation traces, creating privacy and data-governance risk if traces contain sensitive actions or contextual metadata.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: `auto_contribute` causes successful sessions to be uploaded automatically, but this data-sharing behavior is not obviously necessary for the user-facing promise of saving token costs during execution. The mismatch increases the risk of deceptive or over-broad data collection, especially where users may not expect their workflows and metadata to leave the local environment.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The docstring makes a strong privacy guarantee that all identifiable information is stripped before data leaves the node, but the implementation only handles a narrow set of regex patterns and top-level sensitive field names. This can cause operators or downstream code to trust the sanitizer as a complete privacy gate, leading to leakage of unredacted PII in nested objects, uncommon identifiers, free-form text, or values that do not match the limited patterns.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README explicitly describes querying a cloud service before local exploration and contributing successful session traces back to a shared registry, but it does not warn users that prompts, workflow traces, or other session-derived data may be transmitted off-device. In an agent skill context, session traces can contain sensitive operational data, secrets, internal URLs, or personal information, so the lack of prominent disclosure and consent creates a real privacy and data-handling risk.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The usage description suggests the skill may activate broadly against general user intent without clearly stating when it runs or what boundaries limit interception. In an agent skill, vague activation scope is risky because it can cause the skill to process sensitive tasks unexpectedly and route more activity through remote decision or replay paths than the user intended.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The markdown advertises cloud querying and automatic contribution of successful workflows, but it does not prominently warn users that task-related data may be transmitted off-device. Even if credentials are excluded, workflow traces, intent text, URLs, DOM-derived identifiers, and failure details can still expose sensitive business or personal information.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Setting auto_contribute to true by default creates a real risk of silent remote sharing of session-derived workflows and associated metadata. In this skill's context, contribution is especially sensitive because the product is explicitly built around crowdsourcing and replaying automation patterns, so default-on sharing increases the chance that sensitive operational behavior is uploaded without informed consent.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: The comment says the skill queries the cloud on every user intent, implying routine transmission of user intent data to a remote service. Without visible disclosure, consent, or clear scoping of what is sent, this can expose sensitive prompts, business context, or identifiers and creates a privacy and policy-compliance issue even if the feature is intended for caching.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The interceptor flow explicitly states that successful session traces are automatically contributed back to a cloud service, but there is no indication of user notice, consent, scoping, or redaction. Session traces can contain sensitive prompts, credentials, internal URLs, tokens, or business data, so silent exfiltration to a remote service creates a real privacy and data-leakage risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The interceptor sends normalized intent, current URL, DOM skeleton hash, and node identifier to the cloud for every matched request without any user-facing disclosure in this code path. Those fields can reveal browsing targets, user goals, and page structure, which may expose sensitive business or personal activity even if full page contents are not transmitted.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: On workflow execution failure, the code reports `error_detail` to the cloud using raw exception text. Error strings often contain selectors, URLs, page text, or other runtime details that can unintentionally leak sensitive information from the user's environment.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The code automatically contributes successful session traces and the compiled workflow to the cloud after completion, with no visible user warning in this file. Session traces can encode user actions, targets, and possibly secrets or proprietary process logic, making silent upload especially risky in an automation tool operating on live user sessions.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The manifest declares automatic interception hooks for incoming intents and completed sessions, but does not express any meaningful trigger scoping, data minimization, or user-consent boundaries. Combined with browser, network, lobster, and session-history permissions, this creates a broad opportunity to observe and export user activity across many tasks, which is dangerous even if presented as a caching feature.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The skill enables automatic contribution of successful workflows to a cloud endpoint by default, without explicit opt-in language or any visible safeguards around anonymization, review, or sensitivity filtering. In the context of a workflow cache product that benefits from collecting prior agent work, this materially increases the risk of leaking prompts, browsing activity, task context, credentials, or proprietary workflows to a third party.

Ssd 3

High

• Confidence: 96% confidence
• Finding: The session-completion hook converts user session history into a shareable workflow and uploads it along with intent, URL, DOM hash, node ID, and session ID. In the context of a browser automation skill, this is particularly dangerous because sessions may involve logins, internal tools, or proprietary workflows, so automated cloud sharing creates substantial confidentiality and compliance risk.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.