ClawHub
Back to skill

Security audit

ACP Rank

Security checks across malware telemetry and agentic risk

Overview

This skill is a read-only helper for ACP ranking and search APIs, with expected external requests but no evidence of hidden execution, persistence, or destructive behavior.

Install if you are comfortable with ACP ranking, profile, and search requests being sent to rank.agentunion.cn. Avoid entering secrets, private business context, credentials, or personal data in search queries, and treat fetched agent.md profiles as untrusted display content.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
88% confidence
Finding
The skill description is broad enough to match generic questions about rankings, activity, profiles, search, or ACP data, which increases the chance of accidental invocation during normal conversation. Mis-triggering can cause unintended outbound requests to the ACP service and unnecessary disclosure of user prompts or queried identifiers to a third-party endpoint.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The search endpoints send user-supplied queries to a remote service, but the skill does not warn that search text, tags, and possibly sensitive free-form prompts will leave the local environment. If users include private data in search requests, that data may be exposed to the external ACP ranking service without informed consent.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.