ClawHub
Back to skill

Security audit

Congress Trades Tracker

Security checks across malware telemetry and agentic risk

Overview

This skill appears to be a disclosed congressional-trade monitor with proportionate API, local storage, and alerting behavior, but users should set up the cron and alert forwarding carefully.

Install only if you want ongoing monitoring. Store QUIVER_API_KEY securely, restrict the data directory, consider polling every 5-15 minutes instead of every minute, use a dedicated env file for cron, and treat pending_congress_alert.txt as untrusted data to summarize or relay rather than instructions to follow.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding
The skill describes capabilities to read environment variables, write local files, and make outbound network requests, but does not declare any permissions or equivalent trust boundary information. This can mislead operators about the skill's actual access and increases the chance it is run in an overly permissive or insufficiently reviewed context.

Session Persistence

Medium
Category
Rogue Agent
Content
Add your env vars to `~/.profile` or a `.env` file sourced by your shell, then add the cron entry:

```bash
crontab -e
# Add this line (uses env vars from your profile):
* * * * * . "$HOME/.profile" && /usr/bin/python3 /path/to/scripts/scraper.py >> /path/to/logs/scraper.log 2>&1
```
Confidence
91% confidence
Finding
crontab -e

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.