ClawHub
Back to skill

Security audit

Tmp.QzENmcDEHY

Security checks across malware telemetry and agentic risk

Overview

The skill is purpose-aligned but needs review because it handles account passwords and session tokens with under-documented local file exposure risks.

Review before installing. Only use this on a trusted single-user machine, prefer a password manager or short-lived shell scope for the password, treat the cookie jar and /tmp/sug-login-headers.txt as sensitive session credentials, delete them after use, and confirm any RSVP or group-member write before running it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill instructs users to place SignUpGenius credentials in environment variables but does not warn that environment variables can be exposed through shell history, process listings in some contexts, crash dumps, CI logs, or inherited subprocess environments. While this is a common convenience pattern, handling long-lived account credentials this way without any safety guidance increases the chance of credential disclosure.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The login flow writes sensitive authentication artifacts to disk, including a cookie jar containing the JWT accessToken and session cookies, and a headers file under /tmp. On multi-user systems or misconfigured environments, these files may be readable by other processes or linger after execution, enabling session hijacking without needing the account password.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.