ClawHub
Back to skill

Security audit

Tmp.9hBUSF6f0l

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a read-only Angi data helper, but it also documents authenticated account reads through the user's browser session without enough upfront disclosure or consent guidance.

Install only if you are comfortable granting a persistent browser-tab fetch bridge for Angi. Treat the my.angi.com examples as private account access, and only use them when you explicitly intend to expose your own Angi account data to the agent.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The skill metadata frames the capability as reading public Angi directory data, but the body also documents how to access signed-in data from my.angi.com using the browser-tab session. That expands the data boundary from public web scraping to authenticated personal account access, which can surprise downstream agents or users and lead to unintended collection of private account information.

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The documentation claims no cookie, storage, or header scope is declared, but later relies on the browser tab's authenticated session to read private account pages. Even if the skill does not directly exfiltrate cookies, it still leverages ambient browser authentication to access sensitive data, creating a misleading security model and increasing the risk of unauthorized or unexpected private-data retrieval.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill provides procedures for accessing signed-in account data without a clear privacy warning, data-handling guidance, or an explicit requirement to confirm the user intends to expose private account contents. In agentic contexts, this omission makes accidental over-collection more likely because the authenticated fetch looks like a normal read operation despite involving personal account information.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.