ClawHub

Billionverify Skill

Security checks across malware telemetry and agentic risk

Overview

This skill appears to do what it says, but it can send large email lists and webhook data to third parties without enough plain-language privacy and destination warnings.

Install only if you are authorized to send the relevant email addresses or files to BillionVerify. Treat uploaded lists and downloaded results as sensitive data, strip unnecessary columns before upload, review webhook URLs carefully, and avoid using this with regulated or confidential contact lists unless your organization has approved that third-party processing.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (9)

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The README encourages users to upload email lists for bulk verification and configure outbound webhooks, but it does not warn that this sends potentially sensitive personal data to a third-party service and can disclose verification results to externally controlled endpoints. In an agent context, this omission is risky because users may authorize processing of customer or regulated data without understanding the privacy, consent, retention, or destination implications.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill instructs users to submit email addresses and bulk-upload files to a third-party API but does not clearly warn that this data leaves the local environment. This creates a real privacy and compliance risk because users may provide personal data, customer lists, or sensitive files without informed consent or data-handling context.

Missing User Warnings

Low
Confidence
89% confidence
Finding
The documentation describes downloading result files locally and creating webhooks that trigger external callbacks, but it does not warn about the security implications of writing output to disk or sending completion events to user-specified endpoints. This omission can lead to unintended data exposure, unsafe file handling, or webhook misuse if operators assume these actions are purely internal.

External Transmission

Medium
Category
Data Exfiltration
Content
### Verify Single Email
```bash
curl -X POST "https://api.billionverify.com/v1/verify/single" \
  -H "BV-API-KEY: $BILLIONVERIFY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
90% confidence
Finding
curl -X POST "https://api.billionverify.com/v1/verify/single" \ -H "BV-API-KEY: $BILLIONVERIFY_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "email": "user@example.com", "check_

External Transmission

Medium
Category
Data Exfiltration
Content
### Verify Single Email
```bash
curl -X POST "https://api.billionverify.com/v1/verify/single" \
  -H "BV-API-KEY: $BILLIONVERIFY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
90% confidence
Finding
https://api.billionverify.com/

External Transmission

Medium
Category
Data Exfiltration
Content
### Verify Batch Emails (max 50)
```bash
curl -X POST "https://api.billionverify.com/v1/verify/bulk" \
  -H "BV-API-KEY: $BILLIONVERIFY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
91% confidence
Finding
https://api.billionverify.com/

External Transmission

Medium
Category
Data Exfiltration
Content
### Upload File for Bulk Verification
Upload CSV, Excel (.xlsx/.xls), or TXT files (max 20MB, 100,000 emails):
```bash
curl -X POST "https://api.billionverify.com/v1/verify/file" \
  -H "BV-API-KEY: $BILLIONVERIFY_API_KEY" \
  -F "file=@/path/to/emails.csv" \
  -F "check_smtp=true" \
Confidence
97% confidence
Finding
https://api.billionverify.com/

External Transmission

Medium
Category
Data Exfiltration
Content
### Download Verification Results
Without filters returns redirect to full result file. With filters returns CSV of matching emails (filters combined with OR logic):
```bash
curl -X GET "https://api.billionverify.com/v1/verify/file/{task_id}/results?valid=true&invalid=true" \
  -H "BV-API-KEY: $BILLIONVERIFY_API_KEY" \
  -L -o results.csv
```
Confidence
93% confidence
Finding
https://api.billionverify.com/

External Transmission

Medium
Category
Data Exfiltration
Content
### Create Webhook
```bash
curl -X POST "https://api.billionverify.com/v1/webhooks" \
  -H "BV-API-KEY: $BILLIONVERIFY_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
Confidence
92% confidence
Finding
https://api.billionverify.com/

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal