ClawHub
Back to skill

Security audit

Post-Purchase Upsell Flow

Security checks across malware telemetry and agentic risk

Overview

This skill provides coherent ecommerce upsell guidance, with the main caution being to review the Docker and payment setup before using the recommended external app.

Before installing or following the implementation section, review the referenced project's docker-compose.yml, run it in an appropriate local environment, and be careful when connecting payment providers because the flow intentionally involves saved payment methods, off-session charges, and refund handling.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
82% confidence
Finding
The file tells the user to inspect `docker-compose.yml` and run `docker compose up`, noting that images and ports will run, but it does not explicitly warn that this starts services which may listen on local interfaces and could affect the user's system environment. Under the markdown-file warning criterion, this is a system-affecting behavior that would benefit from a brief user warning before execution.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.