ClawHub
Back to skill

Security audit

Solopreneur Assistant

Security checks across malware telemetry and agentic risk

Overview

This is an instruction-only business assistant skill with disclosed use of business files, optional email/calendar access, and scheduled reviews.

Before installing, decide whether you want this assistant’s instructions in your startup files and whether you want recurring heartbeat or cron reviews. If you connect email, calendar, memory, revenue, expense, or client files, use read-only or least-privilege access where possible and keep secrets, credentials, and unnecessary historical data out of the tracked business files.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The skill explicitly encourages optional email and calendar access for automation, which can expose highly sensitive personal and business information such as client communications, schedules, and financial details. Although the skill is not overtly malicious, it does not provide a prominent privacy warning, data-minimization guidance, or handling restrictions before instructing users to connect those sources.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.