ClawHub
Back to skill

Security audit

Tmp.C4MQD2PN2g

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Homes.com query helper that can use the user's signed-in browser session, including saved Homes.com items, but it does not show hidden, automatic, or unrelated behavior.

Before installing, understand that the skill uses fpx and the Transporter extension to make Homes.com requests through your own signed-in browser tab. Only run the saved homes or saved searches recipes when you intend to access that account data, and avoid storing or sharing the resulting HTML or parsed data unless you explicitly want to.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The skill explicitly enables reading the signed-in user's saved homes and saved searches through the user's browser session, but it does not clearly foreground that this accesses account-linked private preference data or require an explicit user-consent step before doing so. Because the tool operates through an already-authenticated browser tab, a user or downstream agent could retrieve personal account data with less friction than expected, increasing privacy and unauthorized-access risk.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The section explicitly documents how to access a signed-in user's saved homes and saved searches through their browser session, which can expose sensitive account-linked behavioral and location data. Even if this is the intended product capability, omitting a clear warning and consent boundary increases the risk that an agent or script retrieves private user data without the user's informed awareness.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.