ClawHub
Back to skill

Security audit

Ecommerce Product Info Generator

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed e-commerce product-analysis helper that may create local output files and use configured image-generation API credentials.

Before installing, confirm you are comfortable providing the listed API credentials and sending product images or extracted product text to the documented AIGC service. Use a custom --output path if you do not want files created on the Desktop, and treat SUDOCODE_API_KEY as an unexplained credential requirement unless the publisher documents why it is needed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
84% confidence
Finding
The trigger phrases are broad enough to match ordinary requests like 'analyze this product' or 'extract selling points,' which can cause the skill to activate unexpectedly and perform filesystem writes and external API processing without sufficiently explicit user intent. In this skill context, the risk is elevated because activation may lead to image analysis, local file creation, and use of configured API credentials.

Missing User Warnings

Low
Confidence
89% confidence
Finding
The skill documents automatic creation of an output folder and file saving behavior without requiring a clear upfront user warning or confirmation. While this is not highly severe, it can still violate user expectations, create unintended local artifacts, and increase risk when broad triggers activate the skill automatically.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.