ClawHub
Back to skill

Security audit

Tmp.7GFm9OEA3w

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent Evite integration, but it uses persistent Evite authentication and broad activation wording around private event data and write-capable actions.

Install only if you are comfortable giving the MCP server authenticated access to your Evite account. Prefer explicit email/password configuration over copied raw cookies, consider setting EVITE_DISABLE_FETCHPROXY=1, and require clear confirmation before sending messages, editing guests, sending invitations, or changing events.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

Medium
Confidence
91% confidence
Finding
The trigger text is overly broad because it includes generic invitation, RSVP, guest list, and party-hosting requests, which can cause the skill to activate for non-Evite workflows. In practice this can route unrelated user requests into a tool that has authenticated read/write access to Evite data, increasing the chance of unintended data exposure or accidental state-changing actions.

Session Persistence

Medium
Category
Rogue Agent
Content
---
name: evite-mcp
description: This skill should be used when the user asks about Evite events or invitations. Triggers on phrases like "check Evite", "my Evite events", "who RSVP'd", "Evite guest list", "RSVP to the party", "message my Evite guests", "create an Evite invite", or any request involving event invitations, guest lists, RSVPs, or party/event hosting on evite.com.
---

# evite-mcp
Confidence
72% confidence
Finding
create an Evite invite", or any request involving event invitations, guest lists, RSVPs, or party/event hosting on evite.com. --- # evite-mcp MCP server for [Evite](https://www.evite.com) — read and

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.