ClawHub
Back to skill

Security audit

Sales Funnel Blueprint

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent sales-funnel planning guide with an optional self-hosted Docker setup reference that users should review before running.

Installers are not bundled with this skill. If you follow its optional Autonnel self-hosting path, review the repository, release tag, docker-compose.yml, images, exposed ports, and secret handling before running Docker, preferably in a test environment without production credentials.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill directly instructs users to fetch and run a third-party repository with `docker compose up` and proceed through setup, but it provides no security warning, trust boundary explanation, or verification guidance. In an agent setting, operational instructions like this can normalize execution of unreviewed infrastructure code, which could expose the host to malicious images, unsafe ports, secrets capture, or supply-chain compromise if the referenced project or its dependencies are tampered with.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.