ClawHub
Back to skill

Security audit

Tmp.MFXhmrYOdH

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Redfin data lookup guide that uses a paired browser bridge, including clearly labeled signed-in saved-home and saved-search access.

Install only if you are comfortable pairing fpx/Transporter with a Redfin browser tab. Use the saved homes and saved searches examples only when you explicitly want the agent to read private Redfin account data, and avoid saving or sharing command output that contains account-specific results.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly states it can access signed-in Redfin saved homes and saved searches through the user's browser tab, but it does not present a clear privacy warning or consent boundary at the point of use. That creates a real risk that an agent or user will invoke authenticated endpoints assuming the skill is only performing anonymous real-estate lookups, resulting in unintended disclosure of private account data from the active browser session.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The documented examples explicitly access signed-in Redfin account data such as favorites and saved searches through a bridged browser tab, but they do not warn that these requests may expose private user-specific data to scripts, logs, or downstream consumers. In an agent skill context, this is risky because an agent could retrieve sensitive account-derived information without clear user consent boundaries or minimization controls.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.