ClawHub
Back to skill

Security audit

Pillow Buying Consultant

Security checks across malware telemetry and agentic risk

Overview

This is a markdown-only pillow shopping guide, with the main privacy caveat that it asks for city-level location even though a broad region should usually be enough.

Safe to install as a shopping aid. Share only approximate location and health details you are comfortable providing, and use a broad region or climate zone instead of city if preferred. For significant pain, sleep apnea, reflux, or diagnosed conditions, use the skill only for shopping specs and consult a qualified medical professional.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill explicitly asks for the user's country and city to tailor climate and product availability, but it does not minimize collection or warn about privacy implications. City-level location is more precise than necessary for most pillow recommendations, and collecting it in a consumer-shopping context increases unnecessary exposure of personal data if logs are retained, shared, or correlated with other user details.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.