ClawHub
Back to skill

Security audit

World Clock Pro: Time & Timezone Converter

Security checks across malware telemetry and agentic risk

Overview

This skill is a narrowly scoped world-clock helper that uses a disclosed public time service and does not show hidden persistence, credential use, or unrelated access.

Before installing, be aware that time and scheduling queries can be sent to worldclock.pro. Avoid including confidential meeting details or sensitive personal locations unless you are comfortable sharing them with that service.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Content
Any HTTP-capable environment can call it directly (JSON-RPC 2.0):

    curl -s -X POST https://worldclock.pro/mcp \
      -H 'Content-Type: application/json' \
      -H 'Accept: application/json, text/event-stream' \
      -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"get_current_time","arguments":{"locations":[{"query":"Tokyo"}]}}}'
Confidence
87% confidence
Finding
curl -s -X POST https://worldclock.pro/mcp \ -H 'Content-Type: application/json' \ -H 'Accept: application/json, text/event-stream' \ -d

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.