ClawHub
Back to skill

Security audit

Analytics Engine

Security checks across malware telemetry and agentic risk

Overview

This is a simple analytics API documentation skill whose tracking and payment behavior is disclosed and aligned with its stated purpose.

Before installing, treat this as a paid external analytics service: avoid sending secrets, raw prompts, regulated data, or direct personal identifiers unless you have a clear policy and consent basis. Monitor x402 payment usage because frequent analytics calls can accumulate cost.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill explicitly exposes event tracking and server-side tracking capabilities but provides no warning or guidance about limiting collection of personal, sensitive, or regulated data. In an agent context, this increases the risk that developers or autonomous workflows will forward raw prompts, identifiers, behavioral data, or other sensitive telemetry to the remote service without user awareness or data-minimization controls.

VirusTotal

56/56 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.