ClawHub
Back to skill

Security audit

Tmp.QSM0AG6Srx

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed, read-only helper for fetching and parsing a user's own Jobber Client Hub pages through an existing signed-in browser session.

Install only if you are comfortable using fpx and a browser extension to fetch pages from your signed-in Jobber Client Hub. Keep hub URLs, fetched HTML, and parsed invoice data private, and delete local page captures such as invoice.html when no longer needed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Low
Confidence
89% confidence
Finding
This markdown recipe includes a shell command that saves fetched client-hub content into `invoice.html`, which is a file write involving potentially sensitive customer or billing data. While the example explains how to read the detail page, it does not warn that the data will be stored locally or may contain sensitive information.

External Transmission

Medium
Category
Data Exfiltration
Content
#     unauthenticated"  (HTTP 200)

# bogus bearer: the token is checked, so the transport is fine
curl -s -X POST https://api.getjobber.com/api/graphql \
  -H 'Authorization: Bearer nope' ... 
# -> {"message":"Token not recognized"}  (HTTP 401)
Confidence
15% confidence
Finding
https://api.getjobber.com/

External Transmission

Medium
Category
Data Exfiltration
Content
Then the Developer API is the right answer and this skill is not: register an
app at `developer.getjobber.com`, take the `authorization_code` grant against
`https://api.getjobber.com/api/oauth/authorize`, and send
`X-JOBBER-GRAPHQL-VERSION` with every request. That is a different integration
with a different archetype — a bearer/direct-API client, no browser bridge.
Confidence
15% confidence
Finding
https://api.getjobber.com/

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.