ClawHub
Back to skill

Security audit

Tmp.UBq6p5ztHg

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed, read-only Compass data helper that uses a browser bridge for Compass requests, with some privacy considerations users should understand.

Install only if you are comfortable pairing fetchproxy for compass.com and having requests made through the Compass browser tab/session you choose. Use a browser profile/session intended for this purpose, and remember that the pairing persists until you remove or disable it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The markdown explains that all requests are sent through the user's signed-in browser tab, which means browser-authenticated session state is being used to access a third-party site. Although this behavior is described technically, it does not clearly warn users about the privacy and account-context implications of sending requests via their active browser session.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.