ClawHub
Back to skill

Security audit

Submit to MEGA(niche)

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent marketplace submission helper with clear authorization and data-minimization guardrails.

Install this only if you want an agent to help submit authorized product or distribution opportunities to MEGA(niche). Review the final payload before it is sent unless you already explicitly asked for submission, and do not include secrets, credentials, confidential customer data, or unrelated personal data.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
84% confidence
Finding
This JSON manifest-like API contract describes AI agents submitting marketplace intent, but it does not define any explicit trigger phrases, activation constraints, or exclusion conditions for when an agent should use this API. Because SQP-1 applies to manifest files, the broad description of agent use without invocation boundaries could lead to unintended use in loosely related submission scenarios.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.