ClawHub
Back to skill

Security audit

Game Account Price Trends

Security checks across malware telemetry and agentic risk

Overview

This skill appears to fetch public game-account listing samples and summarize them into reports without using private credentials or persistent access.

Install only if you are comfortable with the skill making public web requests to mall.yy.com/gamemarket.yy.com and creating temporary listing-sample JSON for reports. Do not provide cookies, account credentials, or browser session headers, because the skill does not need them.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill instructs the agent to execute bundled Python scripts that read local files and make network requests, but it declares no permissions or equivalent trust boundary metadata. This creates a transparency and policy-enforcement gap: an orchestrator or reviewer may treat the skill as low-risk while it can still access the filesystem and external services.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.