ClawHub
Back to skill

Security audit

Internet Lookup Verifier

Security checks across malware telemetry and agentic risk

Overview

This skill is an instruction-only web lookup helper whose main risk is that factual questions may be sent to external search or fetch services.

Safe to install for public factual verification. Avoid using it with secrets, confidential business information, personal data, or regulated data, because the question or a rewritten version may be sent to external search or fetch providers.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger condition is broad enough that the skill may activate based on generic cues from the system prompt, another skill, or common words like 'fact' and 'verify,' causing unintended web searches. This can leak user queries to external services and alter assistant behavior in contexts where verification was not explicitly requested.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill states that it sends the user's question to web_search and may fetch full pages, but it does not warn users that their input may be transmitted to third-party services. In privacy-sensitive or confidential contexts, this can expose personal, proprietary, or regulated information without informed consent.

VirusTotal

58/58 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.