ClawHub
Back to skill

Security audit

Deep Research Suite

Security checks across malware telemetry and agentic risk

Overview

This skill is an instruction-only research helper that searches public sources and saves reports, with no hidden code or install-time behavior found.

Before installing, confirm you are comfortable with the agent browsing public sources and saving generated reports in memory/research/. Avoid using it for sensitive or proprietary research unless you know who can access that storage and how retained reports are deleted.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
93% confidence
Finding
The skill repeatedly states that reports are 'saved to file' under `memory/research/` but does not clearly warn the user up front that invoking the skill may write persistent files. While the write location appears constrained and aligned with the skill's stated purpose, undisclosed persistence can still surprise users, leak sensitive prompts/research into storage, or create unwanted artifacts in shared environments.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.