ClawHub

claw://News

Security checks across malware telemetry and agentic risk

Overview

This is a transparent German ClawNews news skill that fetches ClawNews.de feeds and search results, with disclosed optional memory and alert behavior.

Install this if you want German ClawNews.de briefings and search. Be aware that breaking alerts are intended to remain enabled, proactive checks may occur if your agent supports scheduling, preferences may persist across sessions, and search queries are sent to ClawNews.de.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
86% confidence
Finding
The skill advertises broad trigger phrases such as general requests for 'news' and 'what's new', which can overlap with common user intents outside the narrow ClawNews/OpenClaw scope. In an agent ecosystem, this can cause unintended skill activation, routing users to a single external source when they may have asked for general news, reducing intent precision and potentially exposing browsing or memory actions without sufficiently specific consent.

Natural-Language Policy Violations

Medium
Confidence
80% confidence
Finding
The skill repeatedly mandates German-language output without a user choice or fallback, which can override user preferences and create misleading or inaccessible responses for non-German users. While not a direct code-execution issue, it is a safety and usability weakness because the agent may ignore the user's language context and produce unsuitable output.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal