ClawHub
Back to skill

Security audit

travel-memory

Security checks across malware telemetry and agentic risk

Overview

This travel-memory skill does what it says, but users should understand that their trip details are sent to an external BlueColumn/Supabase API.

Install only if you intend to use BlueColumn as a travel memory service. Avoid storing highly sensitive trip details unless needed, and consider redacting exact addresses, confirmation numbers, or private personal identifiers before sending them to the API.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The skill explicitly instructs agents to send detailed travel history, itinerary data, preferences, and lessons learned to an external API, but it provides no warning, minimization guidance, or consent boundary for potentially sensitive personal data. Travel records can reveal location history, routines, accommodations, and behavioral preferences, which creates privacy and profiling risk if shared unnecessarily or retained insecurely by the third-party service.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.