ClawHub
Back to skill

Security audit

Gmail Spend Optimizer

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Gmail-and-wallet spending analysis helper with read-only email handling and confirmation before profile changes.

Install only if you are comfortable letting the agent read purchase-related Gmail messages and Fleece wallet metadata for spending analysis. Review proposed Fleece profile updates before confirming them, and avoid asking it to save detailed transaction ledgers unless you actually want that retained.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The default prompt auto-invokes a high-sensitivity skill using a broad phrase without any narrowing conditions, confirmation step, or explicit mention of Gmail/Fleece data access. Because this skill analyzes purchase emails and wallet data, broad triggering can cause unintended activation and unnecessary exposure of sensitive financial and email-derived information.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.